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Volume I: Assessment Report 
1.0 Notifi cation and Authorization 

This assessment was initiated out-of-board by the authority of the NASA Engineering and Safety 
Center (NESC) Director on October 13, 2006. Julie Kramer White, Crew Exploration Vehicle 
(CEV) Chief Engineer requested a risk comparison of the Integrated Landing System design 
developed by NASA and the design developed by Contractor- referred to as the LM 604 
baseline. Based on the results of this risk comparison, the CEV Chief engineer requested that the 
NESC evaluate identified risks and develop strategies for their reduction or mitigation. The 
assessment progressed in two phases. 

A brief Phase I analysis was performed by the NESC team to compare the CEV Integrated 
Landing System proposed by the Contractor, as defined in the LM 604 baseline, against the 
NASA TS-LRS001 baseline with respect to risk (safety and reliability). 

During the Phase II effort, the NESC team further examined the areas of critical importance to 
minimizing the overall landing risk, including risk to the crew and the Crew Module (CM) 
during a nominal land-landing. The areas studied included: 

Task 1: Landing System Risk Assessment - Estimate the risk to the crew during landing 
using the LM 606 baseline and postulated landing attenuation system configurations. 

Task 2: Landing System Test and Verification (T&V) Approach - Assess the CEV 
Project’s T&V approach to determine the level of residual risk. 

Task 3: Landing Site Accessibility and Availability - Evaluate implications of relying on 
wind limits to ensure that horizontal velocity at touchdown remains within the CM design 
capability. 

Task 4: CM Roll Control in Preparation for Landing - Assess the requirements and 
capability of the CM roll control concept to orient the CM for an acceptable landing. 

Task 5: Investigate Parachute Effects during Landing - Investigate parachute induced 
effects on CM stability during landing near or beyond the CM’s horizontal velocity 
capability. 

Task 6: Crew Protection System Enhancements - Develop tools to evaluate enhanced 
crew restraints and develop restraint concepts that would enhance crew safety during 
high-g impacts or CM tumbling 

The key stakeholders for this assessment were Ms. Julie Kramer White at the Johnson Space 
Center (JSC), and Mr. Christopher Johnson, JSC, who served as the CEV Project Office liaison. 


Restriction Distribution until Report Approval by NRB and Export Control Review 
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4.0 Executive Summary 

This assessment was performed in two phases. A brief Phase I analysis was performed by the 
Water versus Land-Landing Team (NESC Assessment Number 06-020-E) to compare the Crew 
Exploration Vehicle (CEV) Integrated Landing System proposed by the Contractor, as defined in 
the LM 604 baseline, against the NASA TS-LRS001 baseline with respect to risk (safety and 
reliability). A phase II effort examined the areas of critical importance to the overall landing 
risk, evaluating risk to the crew and to the CEV Crew Module (CM) during a nominal land- 
landing. 

Phase I Results Summary 

The Phase I analysis was performed to compare the CEV Integrated Landing System proposed 
by the contractor Lockheed Martin (LM), as defined in the LM 604 baseline, with the NASA TS- 
LRS001 baseline with respect to risk factors potentially leading to severe injury or loss of crew 
(LOC). Due to the early stage of development for both systems, insufficient detail exists for 
either a numerical risk analysis or reliability calculation, thus the following approach was 
utilized: 

• Focus on potential design reliability - mass, volume, cost, and complexity were 
secondary considerations unless obvious concern existed. 

• Compare the two designs with the proven Apollo Earth Landing System (ELS). 

• Use existing design and performance data from NASA and LM CEV teams. 

• Do not incorporate preliminary requirements changes from the CEV Project’s 
Requirement Analysis Cycle-3 (RAC-3) because the NESC task was run in parallel 
with RAC-3 activities. 

• Develop a functional description for each baseline (functional block/event sequence 
diagram). 

• Quantify/evaluate the relative risks of each function. 

The end result of the comparison/evaluation is summarized in Figure 4.0-1. A list of ten 
concerns (C1-C10) and associated NESC recommendations were generated. The major 
concerns included: 

• Cl - LM 604 - Use of a single drogue to extract all the main parachutes was viewed 
as a critical single point failure. 

• C2, C4 LM 604 - 600 lbm confluence retro-rocket pack mounted at the confluence 
point on the main parachute harness is viable, but will require an extensive 
development and validation program. Primary concerns include deployment without 
contacting CM retrorocket plume impingement, parachute risers, and retrorocket pack 
(200 lbm) re-contact with CM after touchdown. 

• C3 - LM 604 - The use of horizontal wind velocity limits for LM 604 was unproven 
for effectiveness. Insufficient data had been produced to demonstrate that relying on 
operational wind limits without horizontal retrorockets was a viable design option. 
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C5 - LM 604, TS-LRS001 - The reliability and robustness of the apex/Forward Bay 
Cover (FBC) separation system needs to be improved to ensure high reliability and 
adequate clearance with the CM during the mission descent phase. Failure to deploy 
the FBC would result in LOC. 



Figure 4.0-1. Risk Comparison of the NASA TS-LRS001 and LM 604 Landing and Recovery 

System Baselines 


The findings were presented to Julie Kramer White and the CEV Project Configuration Control 
Board (CPCB) on December 2006. Key team members of the NESC Water versus Land- 
Landing Assessment were used to perform this task and were critical in influencing the CEV 
Project and Contractor decision to adopting the NASA TS-LRS001 design as the baseline 
configuration. 

Phase II Results Summary 

A systems approach was required to assess the overall risks since the Landing System design can 
affect multiple CEV subsystems and will operate in a range of landing environments. Figure 
4.0-2 summarizes the six tasks and their relationships. 
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Figure 4.0-2. Systems Approach to the Integrated Landing and Recovery System Risk Assessment 


Phase II Study Task Areas 

Task 1: Integrated Risk Analysis Summary 

The purpose of the Task 1 risk assessment was to identify the risk drivers of different CM 
landing configurations and provide overall risk comparisons of the alternatives. Several 
spacecraft landing configuration baselines were examined including: the LM 606, Zero Based 
Vehicle (ZBV): and a water-lander based on the ZBV with minor modifications, with/without 
vertical / horizontal retrorockets, roll control, and air bags. 

The NESC recommendations included: 

Improve the FBC release (Apex Cover) to minimize interference with drogue parachute 
deployment. 

Increase the horizontal velocity attenuation to protect against under predicted horizontal 
winds at land-landing site, increase stability of the CM during landing, and increases 
landing availability. 

Improve crew occupant protection systems as functional redundancy to any landing 
attenuation system failures. 
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Task 2: Landing System Test and Verification (T&V) Summary 

This task was designed to investigate the completeness of the Landing System T&V plan. A 
landing event sequence diagram was developed and used as the basis of the investigation. The 
major NESC recommendations included: 

• Explicitly add a test program to exercise end-to-end performance of the Landing and 
Recovery System (LRS) with emphasis on interactions between subsystems. 

• Formulate a working group charged with the responsibility for verification of end-to-end 
LRS performance with emphasis on subsystem-to-subsystem and subsystem-to-CM 
interactions. 

• Adopt a strategy of developing specific LRS tests based on evaluation and verification 
needs as opposed to forcing the verification plan to conform to already existing “all 
encompassing” tests. 

• Develop T&V scenarios to test the FBC release, parachute extraction and deployment, 
main heat shield jettison (if required), and active controls used for impact attenuation or 
control during descent, landing, and airbag inflation (if used). 

Task 3: Landing Site Accessibility and Availability Summary 

The terrestrial landing site availability from Low Earth Orbit (LEO) task addressed the 
interaction of continental United States (CONUS) landing accessibility and availability. 
Accessibility is the number of times a given landing site can be physically reached from the 
initial orbit. Availability is defined as the number of times opportunities can be utilized in the 
presence of operational constraints. This study covered accessibility based on orbital mechanics, 
landing site location and CM lift to drag ratio (L/D). Availability topics studied included 
day/night, ascending/descending orbit pass constraints, surface wind conditions and thresholds, 
gust conditions, and Service Module (SM) disposal footprints. 

The task also determined that water-landings were a viable back-up to CONUS-based land- 
landings and could also be used as standalone landings. Suggestions included choosing a water 
based location that takes advantage of ascending and descending pass opportunities (e.g., off the 
coast of California). In addition, because of the flexibility of water-landings - through ship 
movement - additional opportunities for vehicle return become apparent. There were no obvious 
CONUS-based land-landing opportunities for the 28.5 degree inclination orbit. CONUS sites are 
accessible if an inclination change orbit maneuver is performed. 

The major NESC recommendations included: 

• Implement improved wind forecasting at the landing sites because current wind 
forecasting is not sufficiently accurate at the relatively low velocity constraints that are 
important to CM stability. 

• Improve crew protection to guard against misforecast winds or gusts, and to avoid over 
constraining wind placards. 

• Develop a flight test program that can support International Space Station (ISS) schedules 
and be prepared to capitalize on performance envelope expansion opportunities as they 
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emerge. The initial flight test program will be paced by limited opportunities to satisfy 
initial land-landing wind placards. 

• Preplanned water-landing sites can backup missed or unavailable land-landing site 
opportunities. 

Task 4: CM Roll Control in Preparation for Landing Summary 

The use of roll control can optimize the orientation of the crew seat attenuation system for land- 
or water-landings. CEV Project tests show that the CM Reaction Control System (RCS) has 
sufficient torque to meet the ± 30 degree roll requirement with current parachute harness / riser 
designs. The NESC recommendations from the NESC CEV Water versus Land-Landing 
Assessment endorsed the use of roll control, and the recommendation remains applicable 
because: 

• Some form of roll control is useful to orient the CM Z plane with the direction of travel to 
maximize crew safety. 

• There is limited cabin volume and minimal human impact acceleration tolerance in the Y 
axis (lateral impacts). 

• During water-landings, the CM can be oriented to minimize crew impact accelerations. 
This supports meeting reduced impact acceleration requirements for de-conditioned crew. 

Task 5: Main Parachute Release Times during Land-Landing Summary 

The effectiveness of releasing the parachute from the CM at different release times post 
touchdown was examined for a vertical and horizontal landing velocity of 26 and 37 fps, 
respectively. A 37 fps horizontal velocity was used since this velocity represents one of the 
more extreme conditions and is most likely to cause CM rollover. 

For landing conditions where there is a horizontal wind, retaining the parachutes has a 
detrimental effect on CM stability since the drag force on the parachutes can pull the vehicle 
over. The effect of rigging and parachute flexibility has minimal effect on the acceleration and 
roll response so that the trends reported here should be applicable to most parachute system 
designs. Peak accelerations occur early at touchdown where the parachutes have negligible 
effect. Rollover which occurs after touchdown is not significantly affected by the parachutes 
since the parachutes are either slack or have minimal tension, thus applying little or no forces on 
the CM. 

Some form of automated parachute release should be a requirement since in the presence of 
horizontal winds with an attached parachute may cause the CM to be dragged and tumble. This 
is true for both water and land-landing events. 

• An automated system should be required since the release may be required to occur 
within 0.50 seconds of touchdown, which is not sufficient time for a crew operated 
manual release. 
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• An automated release system would be a critical function that must ensure no 
unplanned release events. 

Task 6: Crew Protection System Enhancements Summary 

This task explored the utility of using Finite Element Model (FEM) techniques as a method for 
improving overall understanding of the effects and effectiveness of advanced or modified crew 
restraint systems. While in many aspects simplified, the results of this task indicate that the 
technique is useful and traceable to appropriate and well anchored approaches. This task also 
explored the specific case of incorporating lateral supports to improve the crew’s tolerance to 
high Y-axis accelerations. Simulations indicated that substantial reductions in neck moments, 
cited as being most responsible for severe injury for these sorts of crashes, while showing 
increases in some other forces throughout the body. In particular these simulations indicate that 
substantial improvement in crew safety can be effected, with the caution that care must be taking 
in the detailed design to avoid transferring injurious loads to other parts of the body. Concepts 
were also developed that would allow implementation of suitable restraints. 

The major results of Task 6 included: 

• The Finite Element Analysis (FEA) modeling approach shows promise as a tool for seat 
designers. In this task, lateral supports were studied and could be used to improve crew 
survivability for landings with increased Y-axis accelerations. FEA models can provide a 
design engineering means to understand the effect of these restraints. In addition to 
developing tools, it is important that a practical means exist for implementing design 
solutions. 

• Lateral Seat Support - The use of rigid lateral supports of the type found currently in race 
cars were not directly applicable since these designs would likely be impractical during 
crew ingress and egress. In order for lateral restraints to be used in space flight 
applications, a practical means for implementation with reasonable crew ingress, and 
rapid egress must be developed. In addition the restraint system must be flexible in its 
ability to accommodate crew members of different sizes. During this subtask, several 
lateral restraint concepts were examined. 

• Assuming that the potential for unplanned landings on land cannot be eliminated for a 
CM configured for water penetration or other compromised landing configurations, 
additional crew protection is desirable. 

• The Brinkley Dynamic Response Method criteria define an acceptable environment for 
crews restrained in a specific way. However, it does not provide insight into additional 
or modified crew restraint systems. 

• The use of FEA and anthropomorphic test devices (ATD) tests can allow designers to 
evaluate the effectiveness of alternate restraint systems that can provide crews with 
Brinkley Dynamic Response Method levels of protection in substantially harsher 
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environment. Additional evaluation of industry standard injury criteria should be 
initiated to ascertain the applicability of these criteria to crew protection. 

• Based on the work performed to date, further development and adoption of these 
contemporary design tools and techniques is recommended. 

• Practical methods for implementing additional crew protection appear realistic and 
should be developed. 

Space flight inherently poses risk to the crew during dynamic flight phases. This assessment was 
performed to address specific risk areas identified during the previous study on Water versus 
Land-Landings (NESC Assessment Number 06-020-E) involving the descent and landing phase 
of the mission. New findings and recommendations for the CM parachute architecture, occupant 
protection system, landing attitude, and operational approaches were identified and implemented. 
The Apollo CM remains as a solid reference, which when combined with the NESC team 
experience, allowed the understanding and then improvement on what Apollo had accomplished. 
Finally, additional lessons learned from Apollo Program experience were made to reduce risk as 
part of the T&V program. Given the state of maturity of the CEV Project at this time, those 
recommendations have not yet been implemented. 


NESC Request No.: 06-060-E 


@ 

NASA Engineering and Safety Center 
Technical Assessment Report 

Document #: 

NESC-RP- 

06-060 

Version: 

1.0 

Title: 

Crew Exploration Vehicle Integrated Landing System 

Page #: 

19 of 314 


5.0 Ass essment Plan 

5.1 Charter and Background 

The CEV Project Chief Engineer requested that an integrated risk assessment and various 
associated studies be performed on the CEV Integrated Landing System - referred to as the LM 
604 baseline. The Chief Engineer requested the independent study as preparation for the CEV 
Project’s decision to baseline the LRS. 

A brief Phase I analysis was performed by the Water versus Land-Landing Team (NESC 
Assessment Number 06-020-E) to compare the CEV Integrated Landing System defined in the 
LM 604 baseline, against the NASA TS-LRS001 baseline with respect to risk factors potentially 
leading to severe injury or LOC. This assessment covers CM and crew recovery, but does not 
include post-landing operations. 

The Phase I effort resulted in the requestor asking the NESC to perform an in-depth analysis of 
potential risk to the crew in the Integrated Landing System of the LM 606 baseline as described 
in the following section. 

5.2 Scope 

The scope of this task is limited to an evaluation of potential risks found in the LM CEV 
Integrated Landing System as described in LM 606 baseline. Initially, the NESC 06-020-E 
Water versus Land-Landing study evaluated the Integrated Landing System risks to the proposed 
LM 604 CEV baseline. As the CEV design has matured and many design assumptions have 
changed, the NESC was requested to investigate areas of potential risk in the LM 606 baseline. 

The Phase II study focused on areas of risk associated with the flight terminal phase for the CM 
and developed strategies for reducing or mitigating inherent risks. Risk was evaluated in terms 
of risk to the crew during a nominal land-landing. Additionally the CEV Integrated Landing 
System testing approach was evaluated. 

6.0 Description of the Problem and Approach 

The problem description and approach for the Phase I portion are presented in Section 6.1 and 
the Phase II problem description and approach are presented in Section 6.2. Note: each of the 
problems and approaches has a corresponding data analysis section and paragraph number in 
Section 7.0. 

6.1 Phase I - Comparison of LM 604, TS-LRS001, and Apollo LRS - 
Problem and Approach 

The CEV Project Office requested a risk comparison of the LRS proposed by LM with the 
design developed internally by NASA as shown in Figure 6.1-1. 
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TS-LRS001 

* 2 drogues deployed in 
parallel 


3 parachutes extracted by 
independent pilots 

Vertical bese-mounted retro 

i M k« -r- . 

Released heat shield 

Horizontal propulsion with 
four rockets - meets DSNE 
wind requirements 

Toe-in hang angle of 15* 

Crushable structure 
exposed by heat shield 
release 

Altimeter antennas mounted 
under heat shield 



604 



1 prime drogue, backup 
deployed if prime failed 

4 parachutes extracted 
si maftaneousty by drogue 

Vertical retro at chute 
confluence on users above 
capsule, single gas generator 

Retained, but unlocked heal 
shield 

No horizontal propulsion - does 
not meal DSNE wind 
requirements 

Toe-m hang angle of 20* 

Cashable structure compressed 
by heaft shield upon landing 

Altimeter antennas mounted to 

confluence rocket casing 





Figure 6.1-1. NASA and LM Landing and Recovery Baselines used for Comparison in Phase I 

The primary focus for the Phase 1 task was reliability. Mass, volume, cost, and complexity were 
considered only if an obvious concern existed. The CEV Project’s RAC-3 results were not 
factored into the assessment because this task was run in parallel with RAC-3 activities. A 
qualitative risk assessment was performed because insufficient detail existed for a quantitative 
risk analysis or reliability prediction. 

This assessment relied on existing design and performance data from the NASA (TS-LRS001) 
and LM604 CEV teams primarily from the September - October 2006 timeframe. There were 
no existing formal design documents. Mr. Jim Corliss, Chief Engineer for the CEV Landing 
System Advanced Development Project, provided presentation material regarding landing 
systems from the weekly CEV Government Equipment and Materials (GEM) Office project 
control panel status meetings at JSC. LM data were culled from presentation packages and from 
technical interchange meetings (TIMs) to discuss the status of the LRS design. Additionally, the 
NESC assessment team visited the LM Denver site in October 2006 for a TIM. 


The paradigm for the evaluation procedure was as follows: Entry, Descent, and Landing (post- 
entry) was decomposed into five major sequences, all of which must succeed: 

• Parachute deployment 

• Heat shield unlock or jettison 

• Terminal descent 

• Retrorocket firing 

• Touchdown 
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Each of the five sequences was further decomposed into a set of sub-events or conditions, all of 
which must succeed for the overall sequence to be successful. Each sub-event was evaluated for 
design vulnerabilities with the potential to cause severe injury or LOC. Four categories of design 
vulnerabilities were considered in the qualitative evaluation process. The design vulnerabilities 
were: 

• Brittleness (sensitivity to design assumptions) of performance to flight dynamics, 
environmental factors, or operating conditions. 

• Potential to be a common-cause failure source or susceptibility to a common-cause 
failure. 

• Lack of redundancy coupled with potential reliability issues. 

• Steep drop-off in performance under off-nominal conditions. 

A color code was assigned to each sub-event based on the level of concern relative to the list of 
vulnerabilities. The colors assigned to the sub-events assume that all previous sub-events and 
sequences are successful. Vulnerability concerns by color codes were: 

• Green = low concern (function deemed to be robust). 

• Yellow = moderate concern (design concept may be adequate but robustness 
improvements should be considered). 

• Red = active concern (recommend proactive measures to increase robustness and/or 
change the design). 

• White (no color) = function not applicable to the design. 


Color code assigned to each sub-event based on level of concern relative to the list of 
vulnerabilities as shown in Figure 6.1-3. 
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Figure 6.1-2. Post-Entry Descent and Landing Event Sequence (Functional Decomposition of Main 

Events) for a Successful Landing 


Left half of box is 
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Landing 

Successful 


-► 
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only 
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604 events 


!=□ 


Low concern; function deemed to be robust 

Moderate concern; design concept may be adequate but 
robustness improvements should still be considered 

Active concern; recommend proactive measures to increase 
robustness and/or change design 

Function not applicable to the design 


n Concern colors assigned per sub-eve rt iMider the assunptionthat all 
prevbueajbevBifB and sequences re successful 


Figure 6.1-3. Vulnerability Concern Color Code: Concern Colors Are Assigned per Sub-Event with 
the Assumption that All Previous Sub-Events and Sequences Are Successful 
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6.2 Phase II -Integrated LRS Risk Assessment - Problem and Approach 

The Phase II study focused on determining the areas of risk associated with the terminal phase of 
flight for the CM and developed strategies for reducing or mitigating risks inherent in this phase. 
A systems engineering approach was used to investigate the overall landing risk by investigating 
multiple areas of risk and suggested strategies for reducing or mitigating the risks. 

Analysis of the problem by the NESC assessment team and working with the CEV Chief 
Engineer resulted in six individual tasks that encompassed specific, but related portions of the 
overall landing system concept. The tasks were developed to assess the risk to the crew of 
operating various vehicle configurations in the anticipated nominal descent and nominal land- 
landing environments, and investigate specific landing risk mitigation strategies. The overall 
systems approach is depicted in Figure 6.2-1. 



1 5. Parachute Release Timing 

6. Improved Methods for Crew Protection 


Figure 6.2-1. Systems Approach to the Integrated LRS Risk Assessment 
The tasks and approach are summarized in the following sections. 

6.2.1 Task 1: Entry, Descent, and Landing System Quantitative Risk Assessment Problem 
and Approach 

The NESC assessment team’s objective was to estimate the risk to the crew during landing using 
the LM 606 LRS baseline. The team’s approach was to update the Integrated Risk Matrix from 
the CEV Water versus Land-Landing Study, which provided a quantitative risk assessment of 
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landing. The analysis began with undock through entry, descent, and landing, and included 
various landing configurations (e.g., with and without CM horizontal retrorockets) and site 
conditions. 



Figure 6.2-2. Phases of the Entry, Descent, and Landing Included in the Integrated Risk 

Assessment 


6.2.2 Task 2: Landing System Test and Verification (T&V) Problem and Approach 

The NESC assessment team assessed the CEV Project’s T&V approach with respect to design 
qualification and certification. The original request was to provide an independent assessment 
regarding the CEV Project’s T&V strategy for the CM LRS with respect to design qualification 
and certification. The team found that it was difficult to evaluate strategy since the CEV Project 
T&V planning is still in initial stages. Historically, T&V plans are not developed until the 
Preliminary Design Review (PDR) time frame or after. Early work on T&V planning is also 
problematic because design requirements are in an evolutionary state. 

The team’s opinion was that historical experience should be used to make recommendations 
because the LRS design has heritage from Apollo and Mars exploration programs - while still 
recognizing that the CEV has unique requirements. 

The team restructured the Task 2 objective to develop a recommended set of T&V activities 
based on the team’s experience with similar systems and available knowledge of the efforts to 
date. The goals were to: 

• Develop a set of activities that would comprise a comprehensive entry, descent, and 
landing T&V plan. 

• Provide Project with sufficient T&V information for use as a guide during their T&V task 
planning process. 

• Utilize event-tree methodology to expose the items that must be verified in the absence of 
requirements. 

For each activity, the following was provided: 

• A brief, qualitative description of the activity. 

• Whether the activity should cover exhaustive, bounding, or representative scenarios. 
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• External variables that should be examined. 

• Fidelity of the interfaces to other subsystems or components that interact with the prime 
target of verification. 

6.2.3 Task 3: Landing Site Accessibility and Availability Problem and Approach 

The NESC assessment team’s objective of this analysis was to identify significant trends in 
availability and develop a relative measure of sensitivity for those of special interest. The goal 
was to identify factors that warrant additional attention, not to make probability assessments or 
recommend design or operations criteria. Further, the team was to evaluate implications of 
relying on wind limits to ensure that horizontal velocity at touchdown remains within the CM 
design capability. 

The team addressed the operational implications of implementing various landing scenarios for 
CM return from an ISS orbit. Two quantifiable attributes, accessibility and availability, have 
been defined to guide this evaluation (Figure 6.2-3). 



Figure 6.2-3. Approach to determining Landing Site Accessibility and Availability 


Accessibility is defined as the number of times a given landing site can be physically reached 
from the initial orbit. It reflects the classic Return to Earth (RTE) targeting problem, achieving 
an inertial trajectory that will transition to an earth based coordinate system at a specific time of 
landing and geographic location. This evaluation identifies opportunities to land at a given site 
during a period of interest. 
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• Fidelity of the interfaces to other subsystems or components that interact with the prime 
target of verification. 

6.2.3 Task 3: Landing Site Accessibility and Availability Problem and Approach 

The NESC assessment team’s objective of this analysis was to identify significant trends in 
availability and develop a relative measure of sensitivity for those of special interest. The goal 
was to identify factors that warrant additional attention, not to make probability assessments or 
recommend design or operations criteria. Further, the team was to evaluate implications of 
relying on wind limits to ensure that horizontal velocity at touchdown remains within the CM 
design capability. 

The team addressed the operational implications of implementing various landing scenarios for 
CM return from an ISS orbit. Two quantifiable attributes, accessibility and availability, have 
been defined to guide this evaluation (Figure 6.2-3). 



Figure 6.2-3. Approach to determining Landing Site Accessibility and Availability 


Accessibility is defined as the number of times a given landing site can be physically reached 
from the initial orbit. It reflects the classic Return to Earth (RTE) targeting problem, achieving 
an inertial trajectory that will transition to an earth based coordinate system at a specific time of 
landing and geographic location. This evaluation identifies opportunities to land at a given site 
during a period of interest. 
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iii. inclination 5 1 .63 degree 

b. Edwards Air Force Base (EAFB) wind/gust data for 2006 

2. Multiple site weather from National Oceanic and Atmospheric Administration (NOAA) 
for 2004 [ref. 14]. Geographic data and orbital tracks were derived from Analytical 
Graphics, Inc’s Satellite Toolkit (STK) orbital model 

3. Day-time are initially defined as 0600-1800 local time 

4. Landing opportunities are assumed possible whenever the ISS model flies through a 
cylinder with a radius equal to the CM cross range, projected vertically from the center 
of the landing area (ignores the delta times due to actual reentry timeline) 

5. Toe of SM debris footprint ranges from 370 nm short of landing site in orbital plane with 
no raise maneuver to 1,300 nm with a maximum raise maneuver of 55 fps for L/D 0.35, 
and 230 nm and 1 160 nm for L/D 0.30 

6. No attempt was made to assess the suitability of landing sites, capabilities of specific 
CM designs, compatibility of CM designs with landing site surfaces, or availability of 
more accurate wind forecasting tools. 

7. Analysis is focused on land-landings associated with returns from LEO since they are a 
precursor to lunar operations and must accommodate unique flight test and operational 
constraints. 

Availability is defined as the number of times that accessible opportunities can be utilized in the 
presence of operational constraints. The consideration of operational constraints can only reduce 
the number of potential landing opportunities, this study addresses those concerns. Key 
considerations included were: 

• Surface winds and gust conditions 

• Day/night restrictions 

• Ability to ensure SM debris footprints remain off shore 

A deterministic approach was used to determine landing site availability that included: 

• Collect and evaluate 2006 recorded and forecast wind data for EAFB. 

• Identify EAFB landing opportunities for various forecast criteria and evaluate outcomes 
for each using appropriate wind reports. 

• Consider potential correlation among EAFB, Carson Sink, NV, and the Utah Test Range 
wind data. 

• Consider potential flight demonstration build up plan. 

A statistical approach was also used to determine landing site availability that included an 
examination of the weather forecasts (primarily horizontal winds and gusts) versus the measured 
winds exceeding the CM’s horizontal wind landing capability. 

Additional concerns not addressed were: landing surface conditions, terminal area weather 
(snow, rain), and weather forecasting confidence. While these are broad assumptions, their use 
allows for identification of significant trends and sensitivities in key design drivers (i.e., orbital 
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mechanics and weather patterns and may lead to a more detailed evaluation). The complexity of 
this environment and large number of conditions that merit examination, led to the development 
of an analog evaluation tool, Spacecraft Landing Accessibility and Availability Model 
(SLAAM). SLAAM was created in multiple steps starting with using the simulated orbit data 
modeled in AGI’s STK, tracking the times when the orbiting satellite (ISS) would pass over the 
landing areas specified by the CM L/D and exporting this data into Microscoft® Excel ®. This 
data was then sorted and adjusted for local time, ascending or descending pass types, landing 
location, and SM disposal method. Weather data for EAFB was added in a separate database. 
Lastly, the tool mainly allows the user to sort the data based on their desired inputs. This model 
displays data in both daily and daily/hourly calendar format and geometrically accessible landing 
times while allowing for various user-imposed constraints. Those landing opportunities that fail 
the constraint from the display are removed from consideration. Figure 6.2-5 shows an example 
of the SLAAM user interface along with the sample output. 



Figure 6.2-5. SLAAM User Interface 

6.2.4 Task 4: CM Roll Control in Preparation for Landing Problem and Approach 

The NESC assessment team’s objective was to evaluate the requirements and capability of the 
CM roll control concept to orient the vehicle for an acceptable landing. The approach was to 
determine the previous Apollo missions roll control requirements, the current CM requirements 
for the roll control system, and then: 

• Compare Apollo and CEV CM requirements. 

• Determine what the requirements should be on the roll control system, and identify the 
simplest approach using a combination of modeling and simulation, design, and peer 
review. 

• Deployment altitude, descent times, and range of wind conditions including cross winds 
as function of altitude. 

• Analyze the RCS impulse performance and fuel allocation. 

• Identify accepted range of roll alignment requirement (with confidence of specified 
requirement) for landing. 
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• Estimate torque requirement for range of bearing diameters and compare with RCS 
torque output. 

• Size riser length and thickness requirement based on estimated peak deployment loads 

• Estimate oscillation frequencies, magnitude, and dampening of the CM/parachute system. 

6.2.5 Task 5: Investigate Parachute Release Times during Land-Landing Problem and 
Approach 

The NESC assessment team investigated parachute induced effects on CM stability during 
landing near or beyond the vehicle’s horizontal velocity capability. A concern of the CM 
landing is that structural accelerations will be large causing vehicle damage and/or crew injuries. 
Winds at the landing site could exceed the predicted values and thus exceed the CM capability 
(i.e., environment exceeds capability). Also, the CM accelerations could be large causing 
vehicle and/or crew injuries. The parachute effects are thought to have the potential to pull the 
CM over during conditions such as higher winds, or in some cases to stabilize the vehicle by 
preventing the motion after touchdown. 

The effect of releasing the parachutes at different times after touchdown was investigated in 
terms of CM accelerations and rollover in various horizontal wind conditions. A simplified 
parachute model was developed and coupled to a CM structural model. Simulations were 
performed with vertical and horizontal landing initial conditions and horizontal winds expected 
at the landing sites. 

6.2.5.1 Parachute Model 

The LS-DYNA® FEM originally created for the CM was extended to include the parachutes and 
parachute lines. While CM is expected to utilize three primary parachutes for landing, for the 
purposes of this study the effects of the parachutes and lines are simplified by combining the 
effects into a single parachute concept (Figure 6.2-6). The parachute is modeled as a lumped 
mass whose weight is equal to the total expected parachute weights. The connecting lines are 
modeled as a single line with elastic properties and pre -tensioning. The line is preloaded with an 
initial tension equal to the CM weight so that the coupled vehicle-parachute system is in 
equilibrium just before touchdown. The “cable” element available within LS-DYNA® is used to 
model the line so that the line transmits load when the line is in tension and carries no load when 
the line is slack. The weight of the line is distributed along the length and the mass of the 
parachute is concentrated at the top of the rigging. 
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Figure 6.2-6. 



Conceptual Automatic Parachute Separation on Landing to Prevent CM Tumbling 
(left) and Simplified LS-DYNA ® Model (right) 


The parachute force is applied at the location of the parachute mass. The parachute force is 
computed from the simple drag equation: 


F = C x V 2 


Where F is the parachute force, V is the velocity of the parachute mass, and C is the parachute 
coefficient. C may be determined from the relationship: 


C = 


\ 

2 


xpxCdxA 


Where p is the air density, A is the area of the parachutes, and Cd is the drag coefficient of the 
parachute. An alternative approach to computing the parachute force is to use the equilibrium 
conditions for a nominal landing to compute the coefficient, C. For a nominal landing, the 
parachute force must equal the CM weight so that: 


W = C x V 2 


For this assessment, the nominal vertical velocity was 26 fps and the CM weight was 13,046 lbs 
leading to a parachute coefficient of 0.134. For the present assessment, this coefficient was used 
for both the vertical and horizontal directions. This was a reasonable approximation to the actual 
parachute forces since the parachutes tend to orient themselves so that they efficiently oppose the 
direction of the wind and vehicle motions. Currently, tests are being performed on CM 
parachute systems and as this data is processed a better understanding of the parachute forces 
will be defined. However, for the present study this simplified model of the parachute system 
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and forces was sufficient to explore the effects of the parachutes once the CM touches the 
ground. 

The parachute force was implemented into the LS-DYNA® simulation via a series of lookup 
tables for various wind conditions. During each time step in the transient simulation, the 
computed vertical and horizontal velocity at the location of the parachute mass was used with the 
lookup tables to extract a parachute force in each of the horizontal and vertical directions. These 
forces were then applied at the parachute mass location and used to compute the structural 
response for the step time step. When there was a horizontal wind present, the horizontal wind 
force was added to forces generated from the transient motion of the parachute mass. 

The vertical parachute force is defined as: 

F v = 0.134 xV v 2 lbs 


And the horizontal force is defined as: 


F h = 0.134 x (Y wind 2 + V h 2 ) lbs 

Where V v and Vh are the vertical and horizontal velocities of the finite element node at the 
location of the parachute mass. 

Figure 6.2-7 shows a comparison between the parachute forces computed using the identified 
formulation and the vertical parachute force obtained using the parameters supplied by LM in 
memorandum CEV-LRS-07-001. For descent velocities within those expected for the CM, there 
was close agreement between the LM and NESC assessment team’s predictions. At higher than 
expected velocities there is a divergence between the parachute forces since the LM formulation 
used a parachute drag coefficient that increases with descent velocity (thus increasing the drag 
force) while the team’s formulation employed a constant drag. 
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Figure 6.2-7. Comparison of Results of Parachute Forces from Two Different Computational 

Methods 

LS-DYNA® was used to perform the analysis of CM landings with parachute attachments. This 
program was selected because of its ability to simulate the complex transient dynamic behavior 
of the CM impacting a landing surface. The CM model consisted of a collection of structural 
parts as depicted in Figure 6.2-8. The main portion of the CM, which consists of the pressure 
vessel, associated structure, and internal components, was modeled as a rigid part having inertia 
properties equivalent to the LM 604 CM design. The total weight of the vehicle was 13,046 lbs 
which is lighter than the currently projected design, but was an adequate value for the purposes 
of the present study. 
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a) Seat Attenuation Model b) Seat Attenuation Model 

(Global Coordinate System) (Brinkley Local Coordinate System) 

(Pressure Vessel not Shown) 

Figure 6.2-8. CM Structural Parts used in the Model 

Inside of the CM pressure vessel is the crew pallet. The pallet supports the seats and is 
supported by fifteen energy absorbing landing struts. A portion of the CM inertia properties are 
allocated to the pallet (modeled as a rigid part) to account for the crew and seat weights. While 
the pressure vessel and pallet are modeled as structurally rigid and non-energy absorbing, the 
pallet struts are modeled as energy absorbing since they provide the primary source of landing 
load attenuation. 

The parachute and rigging are attached to the CM FEM so that the parachute attachment point 
passes through the center-of-gravity with the vehicle oriented at the desired hang angle shown in 
Figure 6.2-9. The parachute is attached approximately 190 feet from the attachment point. The 
CM model shown includes a triangular shaped parachute used for visualization purposes only as 
the parachute is modeled as a concentrated mass. 
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Parachute 


Rigging 


Vehicle Ground 

Figure 6.2-9. Overview of the Complete Finite Element Model 

For the purpose of the present study the landing surface is assumed to be a relatively “soft” soil. 
The soft soil model has the effect of lessoning the resulting CM accelerations compensating for 
the fact that most of the vehicle structure is modeled as rigid. A coefficient of friction of 0.60 is 
used to model the contact friction between the CM and soil surface. 


6.2.5.2 Parachute System Elasticity 

Before proceeding with the assessment of the effect of parachute release times, it is important to 
measure the significance of the effect of the parachute system elasticity. For example, if a stiff 
rigging configuration responds significantly differently from a soft system, it is important to 
identify these differences and to either model the system as closely as possible to the actual “to 
be built system”, or to identify differences so that relevant information is available to subsequent 
designers. 

The overall parachute system elasticity is a combination of the elasticity contributed from the 
harness, riser, parachute suspension lines, and the air embedded inside the inflated parachute. To 
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assess the overall effect from these components they may be viewed as a single spring that 
connects the parachute to the CM. When the parachute pulls on the vehicle, the air inside the 
chute compresses and, along with the rigging lines and riser, provides system flexibility. While 
the parachute design may utilize materials such as nylon or Kevlar® which are readily 
characterized, the total system elasticity is more difficult to calculate since it is a combination of 
rigging material, geometry, and aerodynamics. In fact, the compression of the air inside the 
parachute may provide more elasticity than all of the rigging materials combined. 

To provide a reasonable assessment of the system elasticity, or to at least determine if elasticity 
considerations are even a significant issue, three different system stiffness’s were examined for 
their effect of the overall system response. The three stiffness’s are a relatively stiff system 
where the entire parachute/rigging elongates only 1 percent of its length when the CM weight is 
hung from the parachute (i.e. 13,046 lbs hung from a 190 foot parachute system stretches the 
system ~2 feet), a medium system (2 percent elongation), and a relatively soft system where the 
elongation is 5 percent. 

The CM rotation and acceleration resulting from a vertical and horizontal landing velocity of 26 
fps and 37 fps is shown in Figures 6.2-10 and 6.2-1 1, respectively, for the three levels of 
stiffness. The hang angle is 0 degrees. For all three stiffness’s the parachute is kept attached to 
the CM for the duration of simulation. As depicted in the figures, the CM rolls over regardless 
of the system stiffness, which is an expected response for a 0 degree hang angle and horizontal 
velocity. Furthermore, there is no significant different among the three levels of stiffness. The 
simulation resulting from the softest stiffness does rollover slightly less than the other two 
simulations, but the difference in rollover angle is not large. The accelerations at the location 
where the crew are seated are almost identical regardless of the stiffness level. The medium 
stiffness level was used for subsequent simulations since this level is thought to be the most 
reasonable characterization of the actual stiffness. 
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’ A Soft-5% elongation 
' B Med- 2% elongation 
L C Stiff- 1% elongation 


0 0.5 i i js z t* 

Tlinv (Seconds) 

Figure 6.2-10. Effect of Rigging Stiffness on CM Rollover (0 degree hang , Parachute Remains 



Figure 6.2-11. Effect of Rigging Stiffness on Pallet Acceleration (0 degree hang , Parachute Remains 

Attached) 
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6.2.6 Task 6: Crew Protection System Enhancements Problem and Approach 

During the course of this assessment, tools were developed to: 

• Evaluate enhanced crew restraints and to develop restraint concepts that would enhance 
crew safety during high-g impacts or CM rollover. 

• Investigate the use of FEA techniques to model the biodynamic effects of high-g impacts 
with various seat and restraint systems. 

• Establish correlation between the FEA technique and standard methods (e.g., Brinkley 
Dynamic Response Method Model) for the case of standard restraints. 

• Employ FEA to explore one type of advanced crew restraint system. 

At the conclusion of this assessment, these tools were provided to the CEV Project for use in 
evaluating alternative crew seats. 

The effects of crew restraint options on the LM 604 seat strut and seat pallet concept designs 
using traditional “whole body” dynamic response models, and FEA models of (ATDs (e.g., crash 
test dummies) were investigating. The NESC team: 

• Investigated the basic crew seat configuration (legacy) versus race car seat. 

• Determined if FEA ATD models can be developed into design tool that will be 
predictive for advanced crew protection seats. 

• Performed FEA simulations of impacts in the Y- and Z-axis directions (most sensitive 
for crew injury). 

• Compared FEA to Brinkley Dynamic Response Method and biological data. 

• Developed and compare crew seat impact attenuation improvement concepts. 

• Found opportunity to add additional value that involved validating the FEA model 
with recent sled results run by the CEV Project and the Suit Project at Wright 
Patterson Air Force Base. 

7.0 Dat a Analysis 

The data analysis for the Phase I portion is presented in Section 7. 1 and the Phase II data 
analyses are presented in Section 7.2. 

7.1 Phase I - Comparison of 604, TS-LRS001, and Apollo LRS Data 
Analysis 

The NESC team compared the configurations of the reference designs and developed an 
architecture comparison of these designs with the Apollo ELS. Table 7.1-1 lists the points of 
architecture comparison with the Apollo system. 
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Table 7.1-1. Areas of Comparison between the Apollo ELS and the LM and NASA CM LRSs 


Feature Apollo 604 TS-LAS00L 

Pecochue 

Ofouge Chute 

2 deployed in parallel via mortars 

1 prime via mo rta r, backup 
drogue deployed if FSW detects 
prime has failed 

2 deployed m parallel via mortars 

Main Chute? 

3 ring sails, S3. S' diameter 

4 ning sails 

3 ring sail?, 122-6' diameter 

Main Deploy me rvt 

Extracted by 3 independent 
mo rta nfirsd pilots 

Extracted simultaneously by 
single drogue 

Extracted by 3 indeper>dent 
mortar- fired pilots 


tfeatshieid 

Type 

A v co at 

PtCA 

PICA 

Attainment 

Retained for splashdown., load 
path same as for entry 

Reta ned for touchdown, but 
unlocked from entry load path 
pri d r to to ucfi d own 

Jetttisoned after main chute 
deployment 


rer/ftwJi/ Descent ACS 

Type 

Passive 

Active orientation required, uses 
swivel at chute confluence 

Ai^ive orientation required, swivel 
TBD 


fiarfar 

Altimetry 

N/A 

(TBO") Radar 

(TBD' Radar or LIDAR 

Velocimetn 1 

N/A 

(T0O) Doppler or GPS 

(TeO) Dp p pier pr GPS 

Avonics Location 

N/A 

within capsule 

within capsule 

Antenna Location 

N/A 

At chute confluence, mounted to 
retrorocket casing 

At bottom of capsule, under tfie 
heatshield 


Retrorockets 

Vertical 

N/A 

1 rocket w/6 nozzles, (TBD) 
thrust 

4 rackets, 7GG0 lbs thrust each 

Horizontal 

N/A 

N/A 

4 rockets, 94 OD lbs thrust each 

Mounting Location 

N/A 

On risers, at parachute confluence 
point above capsule 

At base of capsule, under the 
heatshield 


The Apollo ELS Subsystem Manager was an integral part of the NESC team and identified the 
areas of design challenge in the Apollo ELS applicable to the LM and NASA LRS baselines. 


A vulnerability concern map that evaluated risk was prepared of sub-events/conditions mapped 
to the five major sequences outlined in paragraph 6.1. Concern colors for each of the reference 
designs were indicated for each sub-event. The 10 concerns, numbered Cl through CIO, were 
associated with the sub-event or sub-events. They are: 

Cl (LM 604) - Main Chute Extraction 

C2 (LM 604) - Retrorocket Extraction 

C3 (LM 604) - Winds and Residual Horizontal Velocity 

C4 (LM 604 and TS-LRS-001) - Retrorocket Firing Chain 

C5 (LM 604 and TS-LRS-001) - Apex Cover Separation 

C6 (LM 604) - Retrorocket Plume Impingement 

C7 (LM 604 and TS-LRS-001) - Capsule Orientation Event 

C8 (LM 604) - Drogue Stabilization 
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• C9 (TS-LRS-001) - Impact Survivability 

• CIO (TS-LRS-OOl) - Heat shield Separation 


An additional level of categorization was also applied to the concerns: 

• 1 st Tier — Considered the most serious and challenging and has architectural 
ramifications for the design: C2, C3, and C4. 

• 2 nd Tier — Considered challenging, but fixable. Does not necessarily have cascading 
effects through the architecture: Cl and C5. 

• 3 rd Tier — Considered to have relatively straightforward fixes: C6, C7, C8, C9, and 
CIO. 

Figure 7.1-1 illustrates the vulnerability concern map, the concern colors for each design, the 
numbered concerns associated with entry, descent, and landing sequences, and the 1 st , 2 nd , and 
3 rd Tier concerns. 



C3 

C3 

C3 

C9 


Figure 7.1-1. Vulnerability Concern Map 
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7.2 Phase II - Integrated LRS Risk Assessment Data Analysis 

This section presents the data analysis of the six tasks included in the Phase II assessment. 

7.2.1 Task 1: Data Analysis for Entry, Descent, and Landing System Quantitative Risk 
Assessment Data Analysis 

The purpose of the risk assessment was to identify the risk drivers of different configurations, 
and provide comparisons of the overall risk of the alternatives. This work was an extension of a 
previous NESC assessment that evaluated the risks of landing the CM on water versus land. 

This previous assessment did not analyze specific vehicles and assumed that key risk mitigating 
features were in place. The current assessment extended the previous analysis to evaluate 
specifics of the current CEV design concepts. The risk metric chosen for this analysis was 
probability of LOC (PLOC). 

7.2.1. 1 CM Landing System Configurations Assessed 

Several candidate CM configurations were assessed and compared, which include: 

• LM 606 was the baseline configuration in the Spring of 2007. It is a primary land- 
lander with airbags and horizontal retrorockets. It did not meet weight allowances, so 
variations were considered. 

• The ZBV was based on the LM 606, but had numerous parts removed (e.g., landing 
system and some redundant components) in order to meet the weight allowance. This 
was the starting point for alternative configurations assessed. It is also the starting 
point for the PDR point of departure (POD) vehicle design (currently scheduled to be 
approved in mid-November 2009). 

• Water-lander, which is essentially the ZBV with minor accommodations for water- 
landing, including roll control. 

• Vertical retrorockets with no horizontal retrorockets on dry soil. 

• Vertical retrorockets with no horizontal retrorockets on wet soil. 

• Vertical and horizontal retrorocket land-lander (soil type does not significantly affect 
outcome), which is equivalent to the LM 606 configuration. 

• Airbags with no horizontal retrorockets on dry soil. 

• Airbags with no horizontal retrorockets on wet soil. 

• Airbags with horizontal retrorockets (soil type does not significantly affect outcome). 

In the ZBV, some multi-level redundancy was removed. For example, some avionics electronics 
was previously multiple fault-tolerant, but was reduced to single fault tolerance (e.g., three 
computers were reduced to two). The NESC team’s calculations determined the reduction in the 
number of computers made a negligible difference because of the used of a common cause 
failure rate of 10 percent of the independent failure rate, so the third unit typically reduces the 
failure rate by less than 1 percent. It was not clear if all manual backup modes were maintained 
in the ZBV, but the team assumed that they were. Similarly, ballistic mode and some trajectories 
were removed from the ZBV. The team did not analyze in detail the risk impact, but instead 
assumed that it would have a minimal impact (i.e., other design features would be used to 
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mitigate new risks that arose from the change). It was also assumed that there would be roll 
control. The importance of roll control for water-landing was not analyzed in detail, but it is 
crucial for land-landings. 

The airbag systems assessed were the Generation 1 airbags by Airborne Systems and the 
Generation 2 biased airbags by Boeing. Boeing’s biased airbags have different pressures in the 
front and rear bags to counteract the center-of-gravity offset, but was not optimized in order to 
maintain acceptable stability at all landing orientations (roll). Generation 2 airbags showed 
improvement over the Generation 1 airbags, thus only the Generation 2 airbags results are 
presented in this study. 

It should be noted that for a given primary land-lander CM configuration, the risk can vary 
widely based on the landing site and landing wind criteria. Section 7.2.3details the analysis that 
was done in selecting landing criteria and the influence of that on landing availability. In this 
section, the primary landing site was EAFB (with backup sites), and the wind forecast go-for- 
landing criteria was 18 fps. In this case tumbling is the number one entry, descent, and landing 
risk for land-landing configurations except for airbags with horizontal retrorockets. At the same 
time, for day landings with three sites, there would be a 10 percent chance of having to wait 200 
hours to land for an ISS return (i.e., landing availability is not likely to be reduced further in 
order to reduce risk). 

7.2.1.2 Mission Risk Description and Design Impacts 

The risk analysis was focused on the landing systems. The mission segments considered was the 
entry, descent, and landing for an ISS mission. This mission segment is shown in Figure 7.2-1, 
along with risk drivers, and key design features that differentiate the LM 606 design from the 
idealized land-landing design previously analyzed. The reentry risk drivers are: 

• Entry 

o Guidance Navigation and Control (GN&C) System Fault After Entry: This 
failure mode represents failure of the system to deliver the vehicle to the proper 
landing site. If the CM does not land on a relatively smooth, flat surface it may 
be subject to tumbling. This failure mode applies only to land- landing. 

o Thermal Protection System (TPS) Failure: TPS failure could cause catastrophic 
failure to the CM, or cause the structure to become overheated and weakened. 
The weakened structure could cause the vehicle to sink during a water-landing. 

o FBC Release Mechanism: Failure of this mechanism and drogue parachute could 
cause the FBC to interfere with deployment of the drogue parachutes. 

• Parachute Descent 

o Two Drogue Chute Deployment Failure: This failure prevents the initial CM 
deceleration and stabilization to allow for successful deployment of the main 
parachutes. 
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o Two Main Chute Deployment Failures: This failure prevents the CM from 
decelerating to safe limits. This failure could result from system faults, or a 
postulated situation where the drogues are released at a time when there are 
sufficient rates to cause the CM to be inverted when the main parachutes are 
deployed causing failure of the deployment. This concept is being evaluated by 
the CEV Project and is not expected to be in the final CM configuration. 

o Apex Cover Re-contact: Once the apex cover is clear of the CM, it is possible for 
re-contact if its drogue chute does not deploy. 

• Landing Risk Drivers 
o Land-Landing 

■ No Heat Shield Separation: The land-landing systems are designed such 
that the heat shield must be jettisoned to allow for operation of the active 
attenuation systems (retrorockets/airbags). Failure of this system will 
cause the capability of the seat attenuation system to be exceeded, or 
make the CM susceptible to tumbling. The idealized vehicle in the 
previous study was assumed to be designed to have a possibility of 
survival. 

■ Altimeter or Retro Failure (Retro Systems): This failure results in an 
early, late, or no actuation of the Retro System. Failure of this system 
will cause the capability of the seat attenuation system to be exceeded, or 
make the vehicle CM to tumbling. This type of system requires a narrow 
timing window for actuation (approximately 1 second), with no back-up. 
The idealized vehicle in the previous study was assumed to be designed to 
have a possibility of survival. 

■ Airbag Failure to Inflate or Deflate Properly (Airbag Systems): A failure 
in this system will cause the capability of the seat attenuation system to be 
exceeded, or possibly make the CM tumble. Timing of the actuation of 
this system is not as critical as for retrorockets. The idealized vehicle in 
the previous study was assumed to be designed to have a possibility of 
survival. 

■ Mispredicted Surface Winds: This failure mode is applicable to systems 
that do not have the capability to remain upright in high surface winds 
(either by design or through active systems such as horizontal 
retrorockets). These systems will typically require that the winds be 
placarded to ensure the capability of the system is not exceeded. This 
failure mode represents the possibility that the weather prediction meets 
the placard, but the actual winds at time of landing can cause the CM to 
tumble. The idealized vehicle in the previous study was assumed to be 
designed to have a possibility of survival. 
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o Water-Landing (Cabin Flooding/high leak rate) 

■ Pressure Relief Valve Went Failure: This failure would cause the CM to 
take on water and begin t sink. Requiring crew emergency egress if the 
recovery is not prompt. 

■ Structural Failure (due to TPS failure): This failure represents the 
possibility of a TPS failure causes overheating (but not destruction) of the 
CM such that it fails during water impact. This failure is assumed to be 
severe enough to cause immediate sinking. 

Another potential risk driver was the contribution of the landing system during a pad abort. 

There is the possibility of a pad abort occurring when there are sufficient winds to blow the 
vehicle back on land. 



NESC CEV Water Versus Land-Landing Study (Before and After) 

7.2. 1.3 Risk Quantification Updates 

Each of the risk drivers that had new information was re-quantified for the LOC end state. The 
overall risk matrix is shown in Appendix A. The results of this are summarized in qualitatively 
in Figure 7.2-2 and Table 7.2-1. Rationale for the quantification is provided in the following 
sub-sections. 
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Contingency 

Operation 

■"Parachutes Only" 
Landing 


•Max 0 Ahnrl 


•Mra-Prediclpd Winds 


■Pad Ahart 

•Mis Predicted Winds 


Current Risk 


Axis 


X-Axis 

(Fyeballs En/aut} 

-insuflicitnfl proiecbon for loss 
ofbas£ mounded landing 
adenuaiiion eysIhti h a 
’parechules only" laming 

■ Deceleration durhft mar 
O/d r as abort 


+X CRlLni-aS 


yHead^eck &. 
\lnternal Irqun&s 
-X WiLflit-23 


\ -> 


Y-AKis 

(Fyeballs left'riijlitj 
“Mis Predicted Winds" 

-Cgrrert seats lack lateral 
SLppadtQ prolecl again;: loss 
of roil control of mte’preicted 
wincs^LECS. 


+Y Cfi 1 Lto 4-14 


f HeadNacfc injuries 
-Y CHUtf-te 


Landing Risk litigation Options 

* Increase stmt length to 3-mches 
♦Waist Belt (for suit torso ring) 


♦ Head & neck nestrants (Hans Device) 
*Head & neck risk unquaitf led 

♦ Ratcheting Harness Straps 


-Lateral seat supports 
♦ Conformal helmet 


* Lateral seat supptuts 
- Conformal helmet 



X 


Z-Akis 

{Eyeballs downvup) 

■Lack of horizontal velgcrfy 
sttermalion rrflYatlow CM :d 
impact sand berm during pad 
abort or allcwiumBlng in 
me -pro deled wndsrgmafe 
durina nonnai lantf ng 


+Z OfHUftt - 152 


<Lower Spine Injures 


-Z Ofliimf -U5 


-Waist Belt (for protection from surt torso nng) 

■ Ratcheting Harness Straps 

- Torso Straps f B-point harness 

- Protect crew against RCS tankage ruptures 

- Protect crew against liberated flight deck debris 

- Spm at risk not qu a nafi ed 

- Protect crew against RCS tankage ruptures 

- Protect crew against liberated flight deck debris 


Figure 7.2-2. Results of the Risk Update 
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Table 7.2-1. PLOC for Risk Driver (Tabular) 



Vehicle Analyzed 

Updated Risk 
Driver 

WvL Land 

(Vertical, 

Horizontal 

Retrorockets 

) 

LM 606 
with 
Airbags 
(dry soil) 

LM 606 
with 

Airbags and 

Horizontal 

retrorockets 

LM 606 
Water- 
Landing 
Only 

LM 606 
with 

Vertical and 

Horizontal 

retrorockets 

LM 606 with 
Vertical 
retrorockets 
Only (dry soil) 

Pad Abort 

8E-5 


1.2E-5 


1.2E-5 


1.2E-5 


1.2E-5 


1.2E-5 


TPS Failure 

2.6E-5 

2.7E-5 


2.7E-5 


2.7E-5 


2.7E-5 


2.7E-5 


GNC and Other 
Entry 

1.1E-5 


1.5E-5 


1.5E-5 


1.5E-5 


1.5E-5 


1.5E-5 














Apex Cover 
Separation 



■ 

■ 

■ 

■ 

■ 

Heat Shield 
Separation Fault 

0 

8.8E-5 


8.8E-5 


0 

8.8E-5 


8.8E-5 










Parachute Failure 













Roll Control 
Failure 

IE-6 

4.2E-5 


4.2E-5 


1.1E-5 


4.2E-5 


4.2E-5 












Retro System 
Failure 

0 

0 

0 

0 

■ 

■ 

Airbag System 
Failure 

5E-6 (airbag 
alternative) 





0 

0 

0 

Mispredicted 

Winds 

0 

HH 

0 

0 

■ 



Structural Failure 
due to Overheat 
(Water-Landing) 

4.4E-5 

0 

0 

2.3E-5 


0 

0 
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Heat Shield Failure 

Several faults can lead to heat shield failure resulting in LOC. For ISS missions this is 
dominated by Micro Meteoroid Orbital Debris (MMOD) damage during extended stays at the 
ISS. This analysis assumed no covering of the heat shield shoulder region that is above the SM. 
The damage leads to increased turbulence during entry and catastrophic failure (LOC). 

Less severe MMOD damage can lead to weakening of the structure that can cause CM sinking. 
For land-landing, similar damage could lead to overheating the landing system, but this was 
assumed to be less likely. An additional, but less probable cause of sinking is structural failure 
due to insufficient margins. 

Heat shield failure during lunar return was also analyzed, but not included because most risks do 
not differ between lunar and ISS cases and ISS return is more frequent. Due to the high heat 
loads for lunar return. Heat shield failure leading to LOC is more likely with a probability of 
1.3E-4. Sinking due to heat shield overheating is also more likely at 2.6E-4. 

Apex Cover Separation 

Risk of apex cover/FBC separation failure increased from the Water versus Land-Landing 
Assessment, mostly due to new concerns about interference with the drogue chutes. 

Heat Shield Separation 

Heat shield separation faults do not apply to the water-lander because it retains the heat shield. 
The driving failure modes are early separation (which results in LOC in all cases) and no 
separation. In the Water versus Land-Landing Assessment, heat shield failure to separate was 
not considered to cause LOC due to the enhanced seat system, and early separation was not 
considered. In the current study, both cases result in LOC, although early separation was given a 
0.75 weighting due to non-fatal cases (i.e., early separation and cases where the aerodynamic 
loads keep the heat shield in place until parachute deployment). 

Roll Control Failure 

Roll control/RCS thruster alignment failure has the same probability of system failure for the 
Water versus Land-Landing investigation and this assessment. However, in the earlier study the 
system failure did not lead to as high of a PLOC due to the superior seat system. Roll control is 
not as critical for water-landing, but there is some risk due to the asymmetric CM structure 
design and the increased risk of sinking at off-nominal roll angles. 

Retro System Failure 

Vertical retrorocket system failure applies only to that particular system, and is a significant 
discriminator between CM configurations. In this study all retrorocket failures were presumed to 
result in LOC, whereas in the Water versus Land-Landing Assessment the seats mitigated the 
fault completely. 
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Airbag System Failure 

Airbag system failure applies only to that particular system, and is a significant discriminator. In 
this study airbag failures were presumed to lead to LOC, whereas in the Water versus Land- 
Landing Assessment the seats mitigated all failure modes except for the pressure release valve 
failure, which was 95 percent mitigated. 

Mispredicted Winds at Landing Site 

The possibility of choosing to land based on acceptable wind forecasts at the time of the go/no- 
go decision, but encountering high winds upon landing was not considered during the Water 
versus Land-Landing Assessment. This was partly because the baseline design included 
horizontal retrorockets that would counteract the winds at the time of landing. However, during 
the current study it was found to be the dominant risk in several vehicle configurations. Details 
about the variability of the winds and landing criteria are provided as part of the separate wind 
task; only the effect on PLOC is discussed here. 

The CM’s horizontal velocity at impact is roughly equal to the surface wind speed. Water- 
landing is not affected by horizontal winds. Airbag systems have been demonstrated to handle 
higher horizontal velocity without tumbling than vertical retrorocket systems. This was achieved 
by timing the pressure release of the outer bag and shaping the airbags to behave like skids. It 
was also found through simulation that the CM will tumble at a lower horizontal velocity on wet 
than on dry soil. In all cases it was assumed that tumbling results in LOC (unlike Soyuz or the 
Water versus Land-Landing Assessment vehicles with their improved seat attenuation). 

These effects led to the CM configuration with vertical retrorockets, but no horizontal 
retrorockets to have unacceptable PLOC of over 1 percent. Airbag systems without horizontal 
retrorockets are marginal (especially when the landing soil is wet and soft). While the risk could 
be reduced with increased landing constraints, those constraints would probably be unacceptable 
due to the resulting loss of landing opportunities (i.e., there could be many days with no landing 
opportunities). Vertical retrorocket systems with horizontal retrorockets have similar 
performance to airbag systems without retrorockets. In this study, it was found that winds are 
handled well by only the airbag system with horizontal retrorockets and the water-lander. 

Structural Failure Due to Overheat 

Structural failure can lead to sinking of a water-lander, which has a high probability of causing 
LOC in a CM with up to six crew members. Although early Apollo tests resulted in sinking 
under nominal conditions, it is assumed that for the CEV Project the main cause of sinking 
would be TPS failure to meet temperature requirements, leading to a weakened pressure vessel 
and high leak rate upon splashdown. 
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7.2.1.4 Risk Observations and Results 

Role and Benefit of Quantitative Risk Assessment to the Process 

The quantitative risk assessment process goes beyond a reliability and safety analysis and is 
based on an evaluation of the entire mission to identify scenarios that could lead to LOC. This 
analysis integrates hazards and equipment reliability with the physics of the scenarios. It may be 
difficult to validate the estimates generated by this process. However, the discipline of 
developing, justifying, and comparing estimates for internal consistency helps keep the project 
focused on appropriate risk drivers. Opening the analysis beyond the standard safety and 
reliability framework provides the opportunity to analyze situations that go beyond hardware 
failure (i.e., mispredicting winds), and considering the possibility of failures due to design 
problems and unknown unknowns that have occurred in the past (i.e., failure of the retrorocket 
system to actuate in the less than 1 second window). 

The risk assessment made it possible to link the CM design features to the mission. In this way it 
was possible to understand the benefit of crash protection in the context of the landing system 
failure modes. Furthermore the analysis helped expose the difference between a land-landing 
capability (on a smooth, flat, dry surface with low horizontal velocities), and land-landing 
survivability during a pad abort. This distinction helps to make visible the capabilities of the 
land-landing vehicle, and understand the benefit of crash protection for any system type. 

Qualitative Results 

It was recognized that the risk analysis is subject to large uncertainties. In order to provide a 
high level interpretation of the results, the risks were color coded to reflect the rough order of 
magnitude of their likelihood. The risks shown in Figure 7.2-1 are: Before (B) representing the 
risk of idealized landing systems (used in the earlier Water versus Land-Landing Assessment), 
and After (A) representing the LM606 configuration. 

Figure 7.2-1 shows an increase in failure from TPS and apex cover separation. These risks are 
currently under design so they may change. But if the apex cover separation requires a parachute 
system to mitigate the risk, then it may remain high along with the other parachute systems 
(yellow to red risk). 

The risks during descent have remained the same. The landing phase shows a risk increase for 
land-landing systems due to the lack of capability to protect the crew during a hard landing 
(resulting from system failure), or after tumbling (due to mispredicted winds). The mispredicted 
surface winds became red due to the lack of horizontal retrorockets that were assumed to prevent 
tumbling in high wind conditions. 
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Quantitative Results 

The total risk for each CM configuration was computed by adding the PLOC for each risk item. 
This approach is viable because the fault probabilities are relatively independent and low. 
Airbag and vertical retro systems without horizontal retrorockets were evaluated for both wet 
and dry soils due to the significantly different tumbling velocities for the soil types. The results 
are presented in Figures 7.2-3 and 7.2-4. 


Comparison of All Options 



Airbags Air Bags Air Bags Water (1 V&H V Retros V Retros 
Dry (1 in Wet(l in H. Retro in 1032) Retros (1 Dry (1 in Wet(l in 
1109) 555) (lin in 543) 63) 23) 

1247) 

Option 


■ Airbag fault 

■ Pad abort 

■ TPS from ISS 

GMC and other entry 

Apex cover separation (needed for parachute 
deploy) 

■ Parachute fault (pilot, drogue, or main) 

■ heat shield separation fault 

■ RCS thruster alignment fault (Capsule Roll) 

■ Retro- rocket fault 

Horizontal Velocity Causes Tumbling 

■ Sinking 


Figure 7.2-3. Comparison of All Options (Uses Generation 2 Airbags) 


Mispredicted wind (landing with high horizontal velocity) was found to dominate risk for 
vertical retro systems without horizontal retrorockets. This risk was unacceptable and tended to 
saturate the bar chart used to compare options. After the vertical retro systems without 
horizontal retrorockets were removed, a new bar chart was generated (Figure 7.2-4) to compare 
the remaining options. 
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Comparison of Lower Risk Options 



Airbags Dry (1 Air Bags Wet Air Bags H. Water ( 1 in V & H Retros 
in 1109) (1 in 555) Retro (1 in 1832) (lin 543) 

1247) 

Option 


Airbag fault 

■ Sinking 

■ Retro-rocket fault 

Horizontal Velocity Causes Tumbling 

■ RCS thruster alignment fault (Capsule Roll) 

■ heat shield separation fault 

■ Parachute fault (pilot, drogue, or main) 

Apex cover separation (needed for parachute 
deploy) 

GNC and other entry 

■ TPS from ISS 

■ Pad abort 


Figure 7.2-4. Comparisons of Lower Risk Options with Generation 2 Airbags (bottom) 


When using the Generation 2 airbags, failure rates within an order of magnitude (PLOC = 1.8 E- 
3 to 9.4 E-4) indicated that they were relatively close considering the order of magnitude 
uncertainty attached to most of the constituent probabilities. Water-landers had the best risk 
(PLOC = 5.3 E-4) due to their insensitivity to wind, soft landing surface, and simplicity (no 
landing mechanisms or retrorockets). Airbags with horizontal retrorockets have the next best 
risk, and are similar to water-landers, but with some added risk for the landing system. 


Airbag systems without horizontal retrorockets on dry soil and vertical retro systems with 
horizontal retrorockets were found to have similar risk, with similar increases in risk over the 
airbag/horizontal retro system due to having similar (decreased) wind speeds for tumbling. 
However, airbag systems without horizontal retrorockets tumble at a lower wind speed than 
those options on wet soil, and so have higher risk. Because it is likely that most landing sites 
would have wet soil at the same time (during rainy winter months), this risk must be considered 
to be an integral part of the risk for the airbag/no horizontal retrorocket CM configuration. 


Overall, mispredicted winds (high surface winds) were found to be the dominant risk due to 
resultant vehicle tumbling. If this risk is mitigated (e.g., using horizontal retrorockets or 
improved seat systems), all of the options are found to have similar risk magnitude considering 
their uncertainties. 


NESC Request No.: 06-060-E 





NASA Engineering and Safety Center 
Technical Assessment Report 

Document #: 

NESC-RP- 

06-060 

Version: 

1.0 

Title: 

Crew Exploration Vehicle Integrated Landing System 

Page #: 

51 of 314 


7.2.2 Task 2: Landing System Test and Verification (T&V) Data Analysis 

The data analysis effort is summarized in Appendix B. Figure 7.2-5 depicts the events and sub- 
events that were examined. 



Figure 7.2-5. CM Event Sequence Diagram Used to Investigate the Completeness of the CEV 

Project’s T&V Approach 


7.2.3 Task 3: Landing Site Accessibility and Availability Data Analysis 

The land-landing site availability from LEO assessment addressed the interaction of CONUS 
landing accessibility and availability as discussed in the following sections. 

7.2.3. 1 Landing Site Accessibility 

Land-landing site accessibility was based on numerous factors. Each of these factors is 
discussed, followed by an integrated graphical representation. A landing opportunity was 
assumed possible when the ISS ground track fell within a specified cylinder projected vertically 
from the center of the landing target. The cylinder radius was equal to the CM cross range 
defined by its anticipated L/D capability. 

CM Lift to Drag Ratio (L/D) 

For this analysis, two L/Ds were under consideration, 0.30 and 0.35. This analysis looked at 
each ratio; the cross range possibilities each presented and determined the sensitivity of L/D 
design. The cross range possibilities for the 0.30 and 0.35 L/D are 60 and 85 nm, respectively. 
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Using a one site landing location as a baseline, this analysis determined how many landing 
opportunities were presented for 180 contiguous days. The cross range capabilities meant that 
the ISS did not need to be directly over a landing site for a landing opportunity to occur, but 
rather the ground track must intersect the cylinder projected vertically from the landing site, thus 
allowing the CM to be guided to the landing site on that orbital track. 

Table 7.2-2 shows the SLAAM output for landing opportunities over a 14 day period, but the 
total passes and average pass per day show the amounts for the 180 days calculated by the 
model. This model displays data in both daily and daily/hourly calendar format and all 
geometrically accessible landing times while allowing for various user imposed constraints. 
Those landing opportunities that fail the constraint from the display are removed from 
consideration. In addition, the SLAAM results displayed represent 180-day periods, starting on 
January 1, 2006. It is reasonable to allow for trends in the 180-day data to represent yearly data. 
The SLAAM display in the table uses following nomenclature: 

‘a’ - ascending pass 

‘d’ - descending pass 

‘OK’ - raise maneuver not necessary 


‘R’ - raise maneuver necessary 

Table 7.2-2. Comparison of L/D 0.30 and 0.35 for EAFB (Edwards) landing site, all options 
available^ (day andjiight), ISO days (Erst 14 days shown ) 


L/D = 0.35 


Start Date 

1/1/2006 















Number of Days 

180 















Site Name 

Day 

1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

Edwards 

Pass 1 


dR 

aOK 

dR 

aOK 


aOK 




dR 


dR 

aOK 

Edwards 

Pass 2 
















Day Total 

0 

1 

1 

1 

1 

0 

1 

0 

0 

0 

1 

0 

1 

1 

# of Landings 

Total Passes 

76 















Ave Pass Per Day 

0.4 














L/D = 0.30 


Start Date 

1/1/2006 















Number of Days 

180 















Site Name 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

Edwards 

Pass 1 


dR 



aOK 






dR 


dR 


Edwards 

Pass 2 
















Day Total 

0 

1 

0 

0 

1 

0 

0 

0 

0 

0 

1 

0 

1 

0 

# of Landings 

Total Passes 

56 















Ave Pass Per Day 

0.3 
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Decreasing the L/D by 0.05 (from 0.35 to 0.30) decreases the CM cross range capability from 85 
to 60 nm with a corresponding reduction in the amount of landing opportunities from 76 to 56, a 
loss of approximately 26 percent. Some sites are available twice per 24 hour period (Pass 1 and 
Pass 2) while on some days the site is not available due to orbital mechanics and the CM cross 
range capability (Figure 7.2-6). An additional note is that some land-landing sites require the 
raise maneuver, shown in Figure 7.2-7. The reentry trajectory targets a SM disposal area off the 
US western coast. After SM jettison, the CM must perform an RCS bum lasting up to 50 
seconds to extend the trajectory downrange to clear the intervening mountains and achieve the 
desired landing site. 



Landing Site with 
maneuverability 
footprint for L/D 
0.35 


Landing Site with 
maneuverability 
footprint for L/D 
0.30 


Descending Passes 


Ascending Passes 


Figure 7.2-6. Problem geometry: illustration of cross range options, ascending and descending 

passes and 3 orbit ground trace 
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Figure 7.2-7. Concept of Operations: CM Disposal and Raise Maneuver 


Ascending or Descending Passes 

The latitude of the landing site greatly influences the ascending/descending pass time spread. 

The closer the landing site to the equator, the more evenly spaced the landing opportunities 
become and conversely, the further toward either pole, the shorter the time between ascending to 
descending passes. For most of the sites chosen for this study, the ascending/descending time 
spread is approximately 16/8 hours (i.e., 16 hours between descending to ascending passes, and 8 
hours between ascending to descending passes). While this aspect of orbital geometry may not 
directly influence landing accessibility, whether or not a pass is ascending or descending might, 
depending on what occurs in each of those scenarios. For example, there may be landing sites 
where all the ascending passes mean a particular SM deorbit procedure is required, therefore 
sorting on ascending or descending was deemed a necessary study tool. The model shows that 
choosing to sort for either ascending only or descending only passes results in a 50 percent 
reduction of landing opportunities. 

Landing Network 

As shown previously in Table 7.2-2, having one landing site has significant limitations. One 
relatively simple idea to increase landing accessibility is to have a network of landing sites. 

Table 7.2-3 displays the results for a representative network of three US western coast landing 
sites: Carson Sink, NV (Carson), EAFB (Edwards), and the Utah Test Range (Utah). Having 
two additional landing sites increases accessibility over one site by 241 percent. 
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Table 7.2-3. Landing accessibility for NASA ’s landing site network, all landing options available, 

180 days. 


Start 

Date 

1/1/2006 















Number 
of Days 

180 















Site 

Name 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

Carson 

Pass 1 















Carson 

Pass 2 















Edwards 

Pass 1 


dR 

K 

dR 

aOK 


aOK 




dR 


dR 

aOK 

Edwards 

Pass 2 















Utah 

Pass 1 















Utah 

Pass 2 
















Day 

Total 

1 

1 

2 

1 

2 

2 

2 

3 

0 

3 

1 

1 

1 

2 


Total 

Passes 

259 















Ave 

Pass Per 
Day 

1.4 















1 . 2 . 3.2 Landing Site Availability 

As mentioned previously, landing site availability is the number of times that accessible landing 
opportunities can be utilized in the presence of operational constraints. The operational 
constraints studied were SM deorbit, day/night landing preferences, wind velocity threshold, gust 
conditions, and the use of water as a CONUS landing site backup is described in the following 
sections. 

Day/Night Constraints 

In certain circumstances and locations, landing either at night only or day only may be 
preferable. Table 7.2-4 shows the differences for day and night only landings, with day and 
night-time each containing 12 hours. For January of 2006, day and night also coincide with 
descending and ascending passes respectively, which is not the case throughout the year. For 
example, in June 2006 day only passes for EAFB opportunities occur on both ascending and 
descending passes. 


Table 7.2-4. Landing site availability for Edwards with day landing only constraint 


Start Date 

1/1/2006 















Number of Days 

180 















Site Name 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

Edwards 

Pass 1 


dR 


dR 







dR 


dR 


Edwards 

Pass 2 
















Day Total 

0 

1 

0 

1 

0 

0 

0 

0 

0 

0 

1 

0 

1 

0 


Total Passes 

38 















Ave Pass Per 
Day 

0.2 
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Surface Wind Constraints 

Past studies indicated that landing systems were sensitive to surface wind speeds. In this 
analysis, the objective was to study landing sensitivity to various wind speed thresholds, diurnal 
and seasonal effects, and site to site wind correlations 

The data for the threshold sensitivity, diurnal, seasonal studies were obtained from the EAFB 
staff meteorologist and included observation and forecasted data for each hour recorded and gust 
conditions. The data for the site correlation study came from Jet Propulsion Lab (JPL) and 
NOAA. 

Diurnal Study 

The diurnal study was completed by examining the hourly wind speed observation data for 
EAFB in 2006, sorting the observations into six 4-hour time blocks, and taking the average wind 
speed for each time block for the year. This study indicated that there are diurnal effects at 
EAFB and the 1600 - 1900 time block has the highest average wind speed. Final results are 
shown in Figure 7.2-8. It is worth noting that while diurnal effects were seen, there were many 
instances of wind variability at all times of day. This study has shown that avoiding certain 
times of day for landing due to diurnal effects is not an effective remedy to the wind situation. 


□ Average Wind 


10.4 


E 

^ 4 




15.35B 





























800-1100 1200-1500 1600-1900 2000-2300 

Time Block (hours) 


Figure 7.2-8. Diurnal wind study results, Edwards 2006 


Seasonal Wind Study 

This study examined the recorded data for seasonal variations. Data for 2006 in the 1600-1900 
time block was used. The year was broken into seasons by month and the average seasonal wind 
speeds were compared with the average yearly wind speed for the chosen time block. The 
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seasonal study also indicated that while the average wind speeds tend to be benign, the data 
shows that averages can be misleading. Figure 7.2-9 shows the results for summer 2006. See 
Appendix B for all seasons. Because this analysis is only for the 1600-1900 time block, the 
annual average differs from the total annual average. 


Summer 


1600-1900 Time Block 
Annual average = 10.4 knots 


* 


c 


(/) 

c 

t 


30 

25 

20 

15 

10 

5 

0 


♦ Wind Speed (knots) 

■ Average Speed (knots) 



0 50 100 150 200 250 300 350 

Observation Number 


June, July, August 2006 

1600-1900 Average Wind Speed Summer = 12.80 (knots) 


Figure 7.2-9. Seasonal Study: Summer 2006, EAFB 


Wind Threshold Sensitivity Study 

The purpose of the wind threshold sensitivity study was to determine what happens to landing 
availability when winds above certain thresholds are eliminated. SLAAM has the capability to 
take wind threshold as a user input and sort accordingly. As the wind threshold increases, 
landing availability increases. Table 7.2-5 through 7.2-8 through show the results for 5, 10, 15 
and 20 knot thresholds at EAFB for 180 days. 
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Table 7.2-5. 5 knot wind threshold (8.4 fps) 


Start Date 

1/1/2006 















Number of 
Days 

180 















Site Name 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

Edwards 

Pass 1 















Edwards 

Pass 2 

















Day Total 

0 

0 

1 

1 

1 

0 

1 

0 

0 

0 

1 

0 

1 

1 


Total Passes 

40 















Ave Pass Per 
Day 

0.2 















Table 7.2-6. 10 knot wind threshold (1 6.8 fps) 


Start Date 

1/1/2006 















Number of 
Days 

180 















Site Name 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

Edwards 

Pass 1 


dR 

aOK 

dR 

aOK 


aOK 




dR 


dR 

aOK 

Edwards 

Pass 2 
















Day Total 

0 

1 

1 

1 

1 

0 

1 

0 

0 

0 

1 

0 

1 

1 


Total Passes 

55 















Ave Pass Per 
Day 

0 . 

3 















Table 7.2-7. 15 knot_ wind_ threshold(253 fps) 


Start Date 

1/1/2006 















Number of 
Days 

180 















Site Name 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

Edwards 

Pass 1 


dR 

aOK 

dR 

aOK 


aOK 




dR 


dR 

aOK 

Edwards 

Pass 2 
















Day Total 

0 

1 

1 

1 

1 

0 

1 

0 

0 

0 

1 

0 

1 

1 


Total Passes 

69 















Ave Pass Per 
Day 

0 . 

4 















Table 7.2-8. 20 knot wind threshold^ (33. 7 fps) 


Start Date 

1/1/2006 















Number of 
Days 

180 















Site Name 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

Edwards 

Pass 1 


dR 

aOK 

dR 

aOK 


aOK 




dR 


dR 

aOK 

Edwards 

Pass 2 
















Day Total 

0 

1 

1 

1 

1 

0 

1 

0 

0 

0 

1 

0 

1 

1 


Total Passes 

75 















Ave Pass Per 
Day 

0 . 

4 
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Figure 7.2-10 shows how the cumulative wind speed capture percentage compares with the wind 
speed at EAFB for 2006. The data shows that if a CM is designed to withstand a wind speed 
listed on the y-axis, one can note the percentage of observations, based on the year’s wind data 
that the vehicle could be expected to accommodate. 



Because wind gusts can cause CM oscillations, this analysis investigated what happens to 
landing availably with gust conditions. Using gust data for the same time period (EAFB 2006), 
SLAAM was used to determine landing availability based on whether there were or were not 
gust conditions only. Shown in Table 7.2-9 are the results for gust elimination at EAFB for 180 
days. 


Table 7.2-9. Gust elimination. No wind threshold F. AFB 2006 


Start Date 

1/1/2006 















Number of 
Days 

180 















Site Name 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

Edwards 

Pass 1 


dR 

aOK 

dR 

aOK 


aOK 




dR 


dR 

aOK 

Edwards 

Pass 2 
















Day Total 

0 

1 

1 

1 

1 

0 

1 

0 

0 

0 

1 

0 

1 

1 


Total Passes 

63 















Ave Pass Per 
Day 

0 . 

4 















Wind threshold and gust elimination can have a significant effect on landing availability. Wind 
thresholds can decrease availability by up to 49 percent with a 5 knot threshold. Gust 
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elimination alone can decrease availability by 1 7 percent. Due to the variability of gusts and the 
unpredictable nature of gusts elimination, an operational constraint may be necessary. 

Forecast Versus Actual Wind 

The differences between actual and forecast wind conditions are worth noting. This assessment 
looked at both forecast and actual data for 2006 at EAFB. In all, there were over 8,500 hourly 
wind and gust observations with two daily forecasts. The actual wind speed exceeded the 
forecast approximately 1,200 times and there were approximately 200 occasions where there 
were non-forecast gust conditions or gusts that exceeded the forecast. This showed that forecasts 
tend to be more conservative, but actual wind and gust conditions frequently exceed the forecast. 
Due to the nature of gust and wind recording methods, there may be situations where gust 
conditions exist or various wind speeds occur, but are not recorded. Reported wind data is the 
latest two-minute average wind speed for the previous hour, and gust data is the highest two- 
minute wind speed average for the last 10 minutes of the previous hour. This data reporting 
method shows how vital information can be non-recorded. 

Wind/Gust Offset 

Because of the nature of weather forecasting and the methods for determining wind and gusts 
speeds, a data-offset capability was introduced into the model. This offset allows the user to use 
the highest value of either wind and/or gust velocity, forecast or actual data for their analysis 
based on time. For example, if a user wanted to use the tool to determine landing opportunities 
with a wind threshold, but wanted to include information on the wind forecast from six hours 
before landing they would have that option. The examples in Tables 7.2-10 and 7.2-1 1 show the 
impact of using the offset option. 


Table 7.2-10. Offset Example, 20knotthreshoM, iw pre- or post-offset, forecastdata 


Start Date 

1/1/2006 















Number of Days 

180 















Data Used 

LD.35 















Site Name 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

Edwards 

Pass 1 


dR 

aOK 

dR 

aOK 


aOK 




dR 


dR 

aOK 

Edwards 

Pass 2 
















Daily Availability 

0 

1 

1 

1 

1 

0 

1 

0 

0 

0 

1 

0 

1 

1 


Total Passes 

74 















Ave Pass Per Day 

0.4 
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Table 7.2-1 1. Offset Example, 20 knot threshold, 6-hour-pre- and 3-hour-post-off set, forecast data 


Start Date 

1/1/2006 















Number of Days 

180 















Data Used 

LD.35 















Site Name 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

Edwards 

Pass 1 


dR 

aOK 

dR 

aOK 


aOK 




dR 


dR 

aOK 

Edwards 

Pass 2 
















Daily Availability 

0 

1 

1 

1 

1 

0 

1 

0 

0 

0 

1 

0 

1 

1 


Total Passes 

68 















Ave Pass Per Day 

0.4 















Due to the offset uses for the highest wind value for the time period specified, the result is a 
more conservative prediction of availability. The offset works similarly for the gust criterion. 

For more information about the offset option, see Appendix B. 

Site-To-Site Correlation 

Based on top level statistical analysis, this study showed that there is some correlation between 
the three previously discussed land network sites: Carson Sink, NV; EAFB, and the Utah Test 
Range. The correlation coefficients for the three pairs are listed below: 

1 . Wind speed correlation for Carson and Edwards = 0.5460 

2. Wind speed correlation for Carson and Utah = 0.5039 

3. Wind speed correlation for Edwards and Utah = 0.507 1 

A correlation of 0.5 indicates a generally positive relationship between wind speeds at both 
locations. This means that the plot of wind speed at one location versus wind speed at the other 
location tend to fall along a line with positive slope. The closer the correlation coefficient is to 1 , 
the closer the points in the plot will fall on a straight line. So, if the wind speed is high at 
Carson, a similarly high wind speed is expected at EAFB. This is not to say that a lower wind 
speed at EAFB is not possible, but the probability of a lower wind speed is smaller than a higher 
wind speed. Table 7.2-12 shows the 2006 site winds for Carson Sink, NV, EAFB, and the Utah 
Test Range, respectively. 
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Table 7.2-12. 2006 Winds, Reported in Knots, at Representative Landing Sites 



CAR 

2006 Winds* Reported in Knots, at Representative Landing Sites 

EQ/V 

UTTC 


6 

Ave 


7 

Ave 

6 

Ave 


33 

Max 


29 

Max 

38 

IVfex 


33 

Percentle 

100% 

29 

Percentle 100% 

38 

Percentle 

100% 

15 


95% 

17 

95% 

17 


95% 

12 


90% 

15 

90% 

14 


90% 

10 


85% 

14 

85% 

11 


85% 

9 


80% 

12 

80% 

9 


80% 

8 


75% 

11 

75% 

8 


75% 

7 


70% 

10 

70% 

8 


70% 

6 


65% 

9 

65% 

7 


65% 

6 


60% 

8 

60% 

6 


60% 

5 


55% 

7 

55% 

6 


55% 

5 


50% 

6 

50% 

5 


50% 


SM Deorbit Method Constraint 

In order to reduce the likelihood of SM debris hitting land, sorting for raise and non-raise 
maneuvers was incorporated into SLAAM. Using the SM debris footprint, Table 7.2-13 was 
developed to classify the ascending and descending passes for each site based on L/D and SM 
debris footprint. “Raise” means a raise maneuver is necessary for landing and “okay” means no 
raise maneuver is necessary. 


Table 7.2-13. Raise maneuver classification 


Site Name 

Approach 

L/D 0.30 

L/D 0.35 

Carson Sink, NV 

Ascending 

Raise 

Okay 

Descending 

Raise 

Okay 

EAFB 

Ascending 

Okay 

Okay 

Descending 

Raise 

Raise 

Utah Test Range 

Ascending 

Raise 

Raise 

Descending 

Raise 

Raise 


Eliminating opportunities that require raise maneuvers reduces availability at EAFB by 5 1 
percent as shown by the loss landing opportunities shown in Table 7.2-14. 
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Table 7.2-14. A vailability at EA FB without Raise Maneuvers 


Start Date 

1/1/2006 















Number of 
Days 

180 















Site Name 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

Edwards 

Pass 1 















Edwards 

Pass 2 
















Day Total 

0 

0 

1 

0 

1 

0 

1 

0 

0 

0 

0 

0 

0 

1 


Total Passes 

37 















Ave Pass Per 
Day 

0.2 















This analysis also quantified what impact the SM deorbit method constraint had on the landing site 
network. Eliminating opportunities that require raise maneuvers for the land-landing network 
decreased the availability by 52 percent, shown in Table 7.2-15. 

Table 7.2-15. Availability at Carson Sink, NV. EAFB, and the Utah Test Range without Raise 


Maneuvers 


Start Date 

1/1/2006 















Number of Days 

180 















Data Used 

LD_.35 















Site Name 


1 

2 

3 

4 

5 

6 

7 

8 

9 

10 

11 

12 

13 

14 

Carson 

Pass 1 















Carson 

Pass 2 















Edw ards 

Pass 1 















Edw ards 

Pass 2 















Utah 

Pass 1 















Utah 

Pass 2 
















Daily Availability 

0 

0 

1 

0 

1 

2 

1 

2 

0 

2 

0 

0 

0 

1 


Total Passes 

124 















Ave Pass Per Day 

0.7 















Statistical Analysis of Landing Site Data to Determine Site Availability 

Landing site availability was determined statistically by an examination of the weather forecasts 
(primarily horizontal winds and gusts) versus the measured winds exceeding the vehicle capability. 
Weather forecast data from EAFB was used as input to a Monte Carlo analysis. Figure 7.2-1 1 
shows a flow chart of the analysis. 
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Figure 7.2-11. Monte Carlo Simulation Flow Chart for Statistical Weather Analysis 


The simulation began by setting the parameters such as the landing, critical, and catastrophic 
criteria. The criteria determined if the CM would attempt to land in the estimated wind 
conditions, and whether the vehicle landed nominally under the experienced wind conditions. If 
the forecasted wind speed is lower than the landing criteria, then the CM could attempt to land. 
If the actual wind speed is higher than the critical criteria, then the CM could experience tipping, 
and if the actual wind speed is higher than the catastrophic criteria then the CM will tumble and 
LOC was assumed. 

Different values correspond to different CM configurations. The baseline landing criteria used 
for previous studies was 18 fps, according to the operational number presented by Marshall 
Space Flight Center (MSFC) in May. The baseline CM configuration used was a vehicle with 
airbags, no horizontal retrorockets, and landing on dry soil. The corresponding critical criteria 
was 38 fps, and the catastrophic criteria was 47 fps. 


NESC Request No.: 06-060-E 


0 

NASA Engineering and Safety Center 
Technical Assessment Report 

Document #: 

NESC-RP- 

06-060 

Version: 

1.0 

Title: 

Crew Exploration Vehicle Integrated Landing System 

Page #: 

65 of 314 


Another parameter was wind gust chance. The gust data used in the studies only gave the 
maximum gust speed experienced during a ten-minute period in an hour, and no information 
about gust length or frequency. Thus, if conditions were gusty, the gust chance parameter 
represented the probability that a gust would happen during the critical landing period. The 
baseline value used in the studies was 20 percent, which is an approximation based on the 
characterization of gusts as roughly sinusoidal. This 20 percent number meant that landing 
vehicle was estimated to experience gusty wind speeds rather than average wind speeds 20 
percent of the time. 

The user could also select the available landing sites. Cases with one site used EAFB, while 
cases for three sites used EAFB, Carson Sink, NV, and the Utah Test Range. The NESC team 
only had gust data for EAFB and was used as a reasonable proxy at low fidelity for the two other 
sites. The other sites provide additional landing opportunities based on orbital analysis. 

The user was able to select the forecast time. This is the length of time prior to touchdown that 
the go/no-go landing decision has to be made. Thus this describes how old the wind forecast 
data will be by the time the landing takes place. This value is typically a product of the 
operational setup, and the value of three hours was used as a baseline. This means that the 
landing decision will be made based on the forecast in effect three hours before the scheduled 
landing. 

After framing the problem, the simulation performed runs up to the specified amount, usually 
about 10 6 runs. For each run the simulation selects a random day to be the first day in which a 
landing is desired. The next landing opportunity is determined from a database of orbital 
accessibility times (assuming a CM L/D of 0.3). Then a set of wind data is chosen randomly 
from the wind speed database according to time of day and time of year of the landing 
opportunity. The data is binned by hour and month, but in order to increase the number of data 
points to choose from the simulation can select from data sets one hour earlier or later; and from 
data sets one month earlier or later. Thus for a landing at 13:00 in May, the simulation would 
select data from the hours of 12:00, 13:00, and 14:00, and from the months of April, May and 
June. Each set of wind data includes the forecasted maximum wind speed, the actual observed 
average wind speed from the end of the hour, and the maximum gust speed in that hour. The 
forecasted data, actual data, and the gust data come from the same hour. 

The forecasted wind speed is then compared to the landing criteria speed. If the forecasted speed 
is too high then the landing is delayed until the next landing opportunity. If the forecasted speed 
is acceptable, then the landing is attempted. To determine the outcome of the landing, the actual 
wind speed (or gust speed depending on the gust chance) is compared to the critical and 
catastrophic criteria. If those criteria are not exceeded then it is a nominal landing, and if they 
are exceeded, then the landing is critical or catastrophic. The data is recorded and the next run is 
completed. 
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After completing all runs, the probabilities of nominal, critical, and catastrophic outcomes can be 
examined. Also the probability of landing delay, and the total delay times for each run can be 
analyzed. 


Critical and catastrophic criteria were chosen for several CM configurations seen in Table 7.2- 
16. These values are for a three hour forecast time (i.e., a forecast in effect three hours before 
the scheduled landing) and 20 percent gust chance (with 0 percent gust chance in parentheses). 
The landing criteria was kept constant for comparison. The tumbling capabilities affect the risk 
directly, with higher capability being better. 


Table 7.2-16. Results from the Monte Carlo Weather A na lysis 



Air-Bag Dry Soil 

(no horizontal 
retrorocket) 

Air-Bag Wet 
Soil (no 

horizontal 

retrorocket) 

Air-Bag 

(with horizontal 

retrorocket) 

Retro Dry Soil 

(no horizontal 
retrorocket) 

Retro Wet Soil 

(no horizontal 
retrorocket) 

Retrorocket 

(with 

horizontal 

retrorocket) 

Go for Landing 

18 

18 

18 

18 

18 

18 

Forecast Criteria, 

(11) 

(11) 

(11) 

(11) 

(11) 

(11) 

fps (kts) 







Actual Landing 

38 

30 

54 

22 

14 

38 

Tipping Criteria, 

(22) 

(18) 

(32) 

(13) 

(8.5) 

(22) 

fps (kts) 







Actual Landing 

47 

38 

61 

30 

22 

47 

Tumbling 

(27) 

(22) 

(36) 

(18) 

(13) 

(27) 

Criteria, fps (kts) 







Probability of 

0.3 

1.1 

0.04 

2.8 

13 

0.3 

Tipping, Percent 

(0.2 - no gusts) 

(1.1 - no gusts) 

(0 - no gusts) 

(2.8 - no gusts) 

(13 - no gusts) 

(0.2- no gusts) 

Probability of 







LOC, Percent 

0.1 

0.4 

0.01 

1.5 

4.3 

0.1 

(Tumbling 

(0.04 - no gusts) 

(0.2 - no gusts) 

(0 - no gusts) 

(1.3 - no gusts) 

(4.1 - no gusts) 

(0.04- no 

Criteria 






gusts) 

Exceeded) 








The Monte Carlo was run for a range of landing criteria in order to examine the sensitivity of the 
landing delay chance and crew risk to that parameter. The assumptions were airbags, no 
horizontal retrorockets, dry soil (38 fps critical, 47 fps catastrophic), 20 percent gust chance, 
three possible landing sites, and a three hour forecast. The results are in Figures 7.2-12 and 


7.2-13. 


The baseline case is 18 fps for comparison. The PLOC is at about le-3 for the baseline, and goes 
above le-2 at about 50 fps landing criteria. The chance of abort is 47 percent at 18 fps. 

As the landing criteria value is increased, the CM is allowed to land under rougher conditions. 
This decreases the chance of landing delay while increasing the chance of crew injury. As the 
landing criteria value is decreased, the operational procedure becomes stricter. The chance of 
delayed landing goes up since it is less likely the conditions will be acceptable, but the risk to the 
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crew goes down since the winds would have to exceed their forecast to a greater degree to be 
dangerous. Thus this is a trade between landing availability and crew injury risk. 

To decrease risk without decreasing availability, it is necessary to improve forecasting to avoid 
being surprised by high winds or to increase the CM capability. The CM capabilities were 
varied to examine the results. The assumptions were landing criteria of 18 fps, 20 percent gust 
chance, and a 3 hour forecast. The results are in Figure 7.2-14. 

Figure 7.2-14 illustrates that increasing the CM capability decreases risk. When the tumbling 
criteria was increased, the CM sees more severe winds in order to roll and injure its occupants. 
When the tumbling critieria is decreased, the CM will be dangerous in a greater range of wind 
speed. The baseline tumbling criteria for an airbag system without horizontal retrorockets 
landing on dry soil is 47 fps. 


Landing Abort Probability 



—♦—Landing Abort 


Figure 7.2-12. Landing delay risk - Chance of abort is 47 percent for the 18 fps baseline case 
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Off-nominal Landing Probability (Airbags, Dry) 



-Critical 
- Catastrophic 


Figure 7.2-13. Logarithmic plot of risk of LOC over criteria 


Probability of Catastrophic Event 
(given 18 fps "Go" ci iteiia) 



Figure 7.2-14. Logarithmic plot of risk of LOC over capability 


Another interesting output was the amount of delay before landing for each run. The time 
between the first available landing opportunity and the actual landing was recorded for every 
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run, with some landing immediately and some being repeatedly delayed (these delays being 
independent). Due to orbital tracks, these attempts can be separated by days or weeks. This data 
can be visualized as a cumulative probability chart, where each point in the chart gives the 
probability that the CM would have landed with that much delay or more. The assumptions used 
are a CM with an L/D of 0.3 (which effects site accessibility), 20 percent gust chance, and three 
hour forecast. Some of the characteristics that were varied were time of day (any time or 
daytime only), number of sites (one or three), and landing criteria. The results are in 
Figures 7.2-15 through 7.2-19. 

For the case of 1 site, 18 fps, and any time landing, there is an approximate 10 percent chance 
that the CM will not have landed after 10 days. If 3 sites are used, then the change of landing 
drops slightly more than an order of magnitude. For the case of 1 site, 18 fps, and daytime 
landing only, there is an approximate 10 percent chance that the CM will not have landed after 25 
days. Allowing three landing sites changes with 90 percent confidence time to 10 days. For the 
strictest case (1 site, 13 fps, daytime only) it takes over 40 days of landing delay to achieve 90 
percent confidence that the CM would have landed. 

Ways to improve these values and lessen the landing delay are to increase the landing criteria, 
allow landing under a wider variety of conditions, or to increase the accessibility of landing sites 
by increasing the number or improving the CM landing range. 


Landing Delay, 1 site, 18 fps criteria Jog plot 



Figure 7.2-15. Landing delay cumulative probability, 1 site, 18 fps 


NESC Request No.: 06-060-E 



@ 

NASA Engineering and Safety Center 
Technical Assessment Report 

Document #: 

NESC-RP- 

06-060 

Version: 

1.0 

Title: 

Crew Exploration Vehicle Integrated Landing System 

Page #: 

70 of 314 



Landing Delay, 1 site, 18 fps criterh, lojj plot {laytime 



Figure 7.2-17. Landing delay cumulative probability, 1 site, 18 fps, daytime 
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Landing Delay,} sites, 1 Sips criteria, log plot, daytime 



Figure 7.2-18. Landing delay cumulative probability, 3 sites, 18 fps, daytime 


Landing D elay, 1 site, 18 fps criteria, log plot, daytime 



Figure 7.2-19. Landing delay cumulative probability, 1 site, 13 fps, daytime 

Another Monte Carlo simulation was run to judge the effectiveness of the Generation 2 airbags. 
The results are summarized in Table 7.2-17. The PLOC for an airbag equipped CM on soil is 
near zero in this simulation when compared with Table 7.2-16. 
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Table 7.2-17. Monte Carlo Results Incorporating Increased Capability of Generation 2 Airbags 



Air-Bag Hard Soil 

Air-Bag Soft Soil 

Retro Dry Soil (no 

Retro Wet Soil (no 

Retrorocket 


(no horizontal 

(no horizontal 

horizontal 

horizontal 

(with horizontal 


retrorocket) 

retrorocket) 

retrorocket) 

retrorocket) 

retrorocket) 

Go for Landing 

18 FPS 

18 FPS 

18 FPS 

18 FPS 

18 FPS 

Forecast Criteria 

(11 KTS) 

(11 KTS) 

(1 1 KTS) 

(11 KTS) 

(11 KTS) 

Actual Landing 

60 FPS 

40 FPS 

22 FPS 

14 FPS 

38 FPS 

Tipping Criteria 

(36 KTS) 

(24 KTS) 

(13 KTS) 

(8.5 KTS) 

(22 KTS) 

Actual Landing 

70 FPS 

50 FPS 

30 FPS 

22 FPS 

47 FPS 

Tumbling Criteria 

(41 KTS) 

(30 KTS) 

(18 KTS) 

(13 KTS) 

(27 KTS) 

Probability of 

0.01% 

0.3% 

2.8% 

13% 

0.3% 

Tipping 

(0% - no gusts) 

(0.2% - no gusts) 

(2.8% - no gusts) 

(13% - no gusts) 

(0.2%- no gusts) 

Probability of 

0% 

0.1% 

1.5% 

4.3% 

0.1% 

Tumbling 

(0% - no gusts) 

(0.02% - no gusts) 

(1 .3% - no gusts) 

(4.1% - no gusts) 

(0.04%- no gusts) 


Shown in Figure 7.2-20 is an update risk trade of landing opportunities versus risk. An analysis 
of the Generation 2 airbag system resulted in using 70 fps for the tumbling criterion on hard soil, 
and 50 fps for the tumbling on soft soil. The CM tipping criteria was set to 10 fps less than the 
tumbling criteria based on CEV Project provided data. The plots in Figure 7.2-20 were based on: 
Generation 2 airbags, hard soil, 20 percent gust, three sites, day landings only, and a three hour 
forecast. As a result, the 18 fps ‘Go for Landing’ criterion resulted in and average of two 
opportunities per week, and a IE-3 PLOC. 
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Figure 7.2-20. Updated Landing Opportunities versus Risk 
7.2.3.3 Water-Landing Possibilities 

The purpose of this portion of the analysis was to determine how water-landing availability could 
work with accessibility. In addition, this analysis was used to determine if and how water could 
be used as a backup to land-landings. 

Water Accessibility 

Water-landing accessibility is similarly based on geometry. However, choosing a location that 
maximized the opportunity for landing is easier in the water due to ship mobility and lack of SM 
debris constraints. Day/night constraints may still play a part. As an assumption to the water 
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accessibility study, a ship was placed strategically to support an ascending and descending 
landing opportunity. Also, it was assumed that this ship could travel at a speed of 15 knots. The 
ship’s motion, in combination with the CM cross range capability meant a large surface area 
would be considered for landing opportunities as shown in Figure 7.2-21. 



Figure 7.2-21. Water-landing illustration 

For example, a ship could be placed at the intersection of the magenta passes and if Opportunity 
1 and Opportunity 2 were missed, could be moved to the intersection of the purple passes with 
sufficient time to “catch” Opportunities 3 and 4. This pattern could be propagated reasonably for 
days and various landing opportunities. For situations where water-landings were limited to day 
or night only, the corresponding number of opportunities would be reduced by approximately 50 
percent. 

Water As Land-Landing Backup 

Due to the flexibility of water-landings and the ability to move the starting point, water-landings 
could readily make the transition from primary to backup landing. For example, in Figure 7.2- 
22, the yellow arrow shows an opportunity to land at EAFB. If this opportunity was missed, the 
subsequent water passes could act as a feasible backup until another land opportunity occurred. 
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Figure 7.2-22. Water as back up to Edwards on 1/5 


To complete this analysis of investigating water as a backup to land passes, SLAAM was 
adjusted to output data in both hours and days to provide the information in a more readable 
format. Figure 7.2-23 shows landing opportunities in relation to each other over time. This is 
the same information in Table 7.2-17 



111 112 113 1M 115 1IB 117 1IB 119 1*10 1111 1*12 1*13 1*14 
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Figure 7.2-23. Landing accessibility for the landing site network, all landing options available, 180 

days (14 days shown for clarity), in hours and days 
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Figure 7.2-24 shows how the opportunities to land change with water as a backup to EAFB pass 
on January 1 and 11. Note how the water-landing site fills in the gaps left by EAFB passes. 



in 1*2 io im i/s lie if? if b iia mo mi 1/12 ina inn 


| * Utah ♦ Edwarclg Carson Water (Eclwarcla Back i_i | i»> ] 

Figure 7.2-24. Water as back up to EAFB 
CONUS for 28.5 Degree Inclination Orbit 

The purpose of looking at the 28.5 degree inclination orbit was to determine if any CONUS 
landing opportunities existed. As illustrated in Figure 7.2-25, there are no CONUS land-landing 
sites available for 28.5 degree inclination orbits. Figure 7.2-25 also shows an example landing 
location in the Pacific Ocean, with a circle reporting the radius of where a ship could move in 24 
hours to support a landing opportunity. This study did verify that if an appropriately sized delta- 
velocity was applied to the CM for an inclination change, a CONUS based landing site could be 
reached. 
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Figure 7.2-25. Lunar inclination CONUS landing evaluation 


7.2.4 Task 4: CM Roll Control in Preparation for Landing Data Analysis 

While roll control was included in the original Apollo specification, it was ultimately not 
included as a capability for use during landing. However, the CM was required to land in any 
possible roll orientation. Roll control was referenced in the original Apollo Program 
requirements. Although the potential advantages of roll control were recognized, no attempts 
were made to implement roll control for landing. Apollo had requirements for both nominal and 
emergency crew acceleration limits and onset rates (Figure 7.2-26). When it was determined that 
these levels could not be met during a land-landing, the Apollo Program accepted the risk based 
on the low probability of a pad abort. 


The NESC team found that there should be sufficient capability in the RCS to orient the CM per 
the CEV Project requirements with low riser angles. The CEV Project had performed parachute 
riser / attachment torque tests to verify the capability. The CEV Project found torque resistance 
of baseline riser /attachment design needed to be reduced, and subsequently tested designs with 
sufficiently low torque resistance (with margin). The results of these tests are provided in Figure 
7.2-27. 
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Figure 7.2-26. Crew Acceleration Limits for the Apollo Command Module 
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Figure 7.2-27. CM Roll Torque Capability Under Main Parachutes 


The CEV Project tests show that the CM RCS has sufficient torque to meet the +30 degree roll 
requirement with current parachute harness / riser designs 

7.2.5 Task 5: Investigate Parachute Release Times During Land-Landing Data Analysis 

The effectiveness of releasing the parachute from the CM at different release times post 
touchdown is examined for a vertical and horizontal landing velocities of 26 and 37 fps, 
respectively. A 37 fps horizontal velocity was used since this velocity represents one of the 
more extreme conditions which is most likely to cause higher rollovers. The 15 degree hang 
angle is fairly optimal for CM stability in the presence of a horizontal landing velocity, while a 
flat 0 degree hang angle may be advantageous for a purely vertical landing. 

The transient rigging force is shown in Figure 7.2-28. The force starts at 13,046 pounds which is 
the CM weight and the initial tension in the rigging just before touchdown. Upon touchdown the 
rigging force quickly decreases as the ground stops the CM from further motion and the 
parachute continues to descend. At 0.17 seconds the rigging goes completely slack and remains 
slack until near 0.4 seconds where the tension begins to increase as the horizontal wind load 
drags the parachute beyond where the CM is contacting the ground. 
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Figure 7.2-28. Rigging Force without Chute Release at a 15 degree Hang Angle 


Figure 7.2-29 depicts the effect on CM roll of releasing the parachute at different times beyond 
initial ground contact. When the parachute is released at touchdown (chute quick release), the 
CM roll is a minimum compared to all of the other release times examined. When the release 
time is at 0.17 (when the rigging first becomes slack), 0.08, and 1.00 seconds, the CM roll is 
similar and is greater than when the parachute is released at 0 seconds. When the parachute is 
kept attached for the duration, the horizontal wind force on the parachute dominates and the CM 
tumbles. 


NESC Request No.: 06-060-E 


@ 

NASA Engineering and Safety Center 
Technical Assessment Report 

Document #: 

NESC-RP- 

06-060 

Version: 

1.0 

Title: 

Crew Exploration Vehicle Integrated Landing System 

Page #: 

81 of 314 



_fi_0.00-y-rot-1 
B O.OB-y-rot-1 
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Figure 7.2-29. Effect of Parachute Release Time on CM Roil - 15 degree Hang Angle, CM does not 

rollover when chute released before 1.0 seconds. 


Figure 7.2-30 shows the resultant acceleration at the location of the crew members for the 
different values of parachute release times. The maximum acceleration occurs below 0.20 
seconds. Beyond the peak acceleration, the acceleration profiles are similar for all release times 
except for the case where the parachute is not released. For this case the second peak in the 
acceleration profile near 0.50 seconds is larger than for the rest of the cases. This peak occurs 
after the CM “bounces” and incurs a second landing. The peak is larger for the parachute 
without release since the parachute pulls the CM higher off the ground than for the other cases 
where the parachute is released. 
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Figure 7.2-30. Effect of Parachute Release Time on Pallet Acceleration 15 degree Hang Angle 


Figure 7.2-31 shows a CM cross section for the 0 degree hang angle. For this angle the 
parachute attachment point is moved to directly above the center-of-gravity. 
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Figure 7.2-31. 0 Degrees Hang Angle (Rigging Attachment Located to Maintain Hang Angle) 

Figure 7.2-32 shows the transient rigging force for the case where the parachute is not released. 
Similarly to the 15 degree hang angle results, the force starts at 13,046 pounds and upon 
touchdown the rigging force quickly decreases then the tension increases as the horizontal wind 
load drags the parachute. For the 0 degree hang angle the parachute first becomes slack at 0.16 
seconds. 
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Figure 7.2-32. Rigging Force without Chute Release 0 degree Hang Angle 


Figure 7.2-33 depicts the effect on CM roll of releasing the parachute at different times beyond 
the time of initial ground contact. In general, the CM roll is similar regardless of the release 
time. When the parachute remains attached for the duration, the CM roll is slightly less than for 
the other cases for part of the response but converges to the same roll at the end of the 
simulation. All the cases converge to the same roll since the CM has rolled over and is resting 
on its top. Figure7.2-34 shows the resultant accelerations for the different release times and 
similar to the roll profiles the acceleration profiles are similar for each case with a peak 
acceleration near 0.20 seconds then a second spike in the acceleration when the CM rolls over 
and the top strikes the ground. 
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Figure 7.2-33. Effect of Parachute Release Time on CM Roll 0 degree Hang angle, Vehicle rolls over 

for all cases 



A 0.01 -paJlet-accel-1 
B O.IG-paJlet-accel-1 
C 1 .00-paJlet-accel-1 
D 4.00-paJlet-accel-1 


Figure 7.2-34. Effect of Parachute Release Time on Pallet Acceleration 0 degree Hang Angle 


Figure 7.2-35 shows the effect of horizontal landing velocity and parachute release time on CM 
rollover. Figure 7.2-36 are for a CM with a 0 and 15 degree hang angle, respectively. In the 
presence of a horizontal landing velocity the 15 degree hang angle is more stable. While the 
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vehicle with a 1 5 degree hang angle can accommodate a horizontal landing velocity of close to 
65 fps, the CM with a 0 degree hang angle rolls over when the horizontal velocity is 30 fps. 

Note that these rollover velocities are relative and additional study is needed to determine values 
that are more absolute. As depicted in the figures, parachute release time has minimal effect on 
CM rollover. For the 15 degree hang angle the release time has no effect on rollover so long as 
the parachute is released before 0.18 seconds. For the 0 degree hang angle the allowable 
horizontal velocity before rollover occurs is slightly higher when the parachute is released at 
touchdown. However, similarly to the 15 degree results release time does not significantly affect 
rollover. Release times beyond 0.18 seconds because the rigging goes back into tension the 
tension is a result of the horizontal wind always has a detrimental effect on rollover. Thus, the 
parachute should always be released before the rigging regains tension. 

A CM employing airbags for landing load attenuation has conflicting requirements with a 
vehicle configuration striving to minimize rollover potential. Airbags are most effective for a 
flat (0 degree hang angle) landing and are less effective when there is a horizontal landing 
velocity or the vehicle lands with a hang angle. However, there can be situation when there is a 
horizontal landing velocity and if the CM hang angle is 0 degrees to optimize the airbags 
effectiveness, the vehicle will be more prone to rollover than if the hang angle was 15 degrees. 



Figure 7.2-35. Effect of Horizontal Velocity on Rollover 0 degree Hang Angle, Vertical velocity = 

26 fps, No Roll 
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Figure 7.2-36. Effect of Horizontal Velocity on Rollover 15 degree Hang Angle, Vertical Velocity = 

26 fps, No Roll 

7.2.6 Task 6: Crew Protection System Enhancements Data Analysis 

The last phase of all manned space missions is the landing and recovery phase. The CM will 
descend to earth with a parachute and should be capable of a primary land-landing and water- 
landings. Consequently, landing systems must be designed for multi-terrain impacts. Earth 
terrain is highly variable, with soil at proposed landing sites at EAFB typically very hard and soil 
at Carson Sink, NV often very soft. 

To keep the size of parachute systems reasonable and to optimize the weight of the landing 
system, the terminal velocity of most parachute recovery systems is approximately 25 to 40 fps 
(17-27 miles/hour). In addition to the terminal sink (vertical) velocity, the parachute and capsule 
will move horizontally with the air mass depending on the wind speed. The velocities of the CM 
at touchdown are typical of crash impact velocities of small aircraft and helicopters. Thus, these 
impact velocities will produce injuries without some type of mitigation for impacts onto land. 
Water-landings do not require additional mitigation for nominal landings since the water acts as 
a natural impact attenuator. The Apollo capsule was designed to impact the water with a hang 
angle of 27 degrees. Since the Apollo capsule entered the water pitched at an angle (thus giving 
it a wedge shape), the acceleration experienced was nominally 10 g or less for a 30 fps impact 
[ref. 1], The Apollo spacecraft also had crushable ribs and a crew seat pallet with stroking 
energy absorbers to alleviate off-nominal impacts. However, either a land-landing in an abort 
condition or a flat 0-degree attitude water impact with one chute out was expected to result in 
occupant injuries. Since the probability of a pad abort with a land impact was considered to be 
low, the Apollo Program accepted those risks. 
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Under ideal nominal conditions, either a land-landing with retrorockets or airbags, or a water- 
landing will result in tolerable accelerations to the crew if the seats and restraint systems are 
adequately designed. For off-nominal landing conditions, a stroking seat pallet similar to the 
Apollo design is planned for CEV Project CM should reduce the impact accelerations to limits 
that are tolerable and prevent crew injury. However, some mitigation for more severe off- 
nominal impacts can be designed with little weight penalty if a systems approach is taken early 
in the design phase. 

With properly designed seats (i.e., with side supports and restraints), relatively high accelerations 
can be tolerated with no or minimal injury, especially for impacts with the crew lying on their 
backs in a seat oriented as shown in Figure 7.2-37. The local axis system has the +X-axis 
upward, the -i-Z-axis pointed toward the head, and the +Y-axis to the right. Note that the axis 
system typically used for a seat is a left-handed system. For accelerations along the +X-axis, 
which would occur for a flat impact, the acceleration in the spine-to-chest direction is commonly 
called “eyeballs in.” An acceleration along the -X-axis (chest-to-spine) is called “eyeballs out.” 
An acceleration from pelvis-to-head along the +Z-seat axis is called “eyeballs down,” and an 
acceleration pointing in the -Z-axis is “eyeballs up.” The seat coordinate system is a local 
system, and is a non- inertial axis system. Hence, any angular rotations with respect to an inertial 
system must be considered. 



Figure 7.2-37. Six Crew Configuration with local X, Y, and Z-Axis 

Human tolerance to impact has been studied continuously since the advent of the automobile and 
airplane. During the Apollo Program, over 288 impact tests were conducted for NASA on 79 
male volunteers using the Holloman Daisy Accelerator [ref. 2], The acceleration onset rates 
ranged from 300 to 2500 g per second. In general, lower onset rates are better tolerated. These 
tests were designed to help understand the effects of water impact on the crew. 
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The US Air Force and Navy have conducted impact test programs in an effort to make ejection 
seats as safe as possible. Sled impact testing of volunteers has been conducted for low, non- 
injurious accelerations. Cadavers, animal surrogates, and ATD’s, such as the Hybrid II and III 
have been used in sled tests to help determine the threshold of moderate and severe injuries. A 
comprehensive compilation of many of these tests that provides summary charts with regions of 
uninjured, moderate, and severe injuries versus maximum continuous sled acceleration and 
duration was produced by Eiband at NASA Lewis [ref.3]. The testing performed in this work is 
relevant to orientations where the loading is directly up through the spine from the buttocks to 
head and is less relevant to CM landings where the nominal loading is in the eyeballs out 
direction. 

7.2.6. 1 Mathematical Lumped Mass Injury Models 

In order to reduce injuries produced during ejection from military aircraft, relatively simple but 
effective mathematical representations of a seated human were developed. Ejection seats were 
first designed based on acceleration limits in the +Z-direction and acceleration onset rates. Early 
on, it was determined that accelerations were better tolerated by aviators if the ejection 
acceleration onset rate was as low as practical. As ejection seats evolved and became more 
complex (i.e., those with thrust vectoring rockets and encapsulated seats in the B-70 and F-l 1 1), 
peak acceleration and onset rate proved ineffective for evaluating their performance. New 
design tools became necessary. The impact tolerance charts produced by Eiband were useful, 
however their application to an arbitrary acceleration pulse that includes accelerations along all 
three axes (X, Y, and Z) is subjective. An example of an Eiband chart for accelerations along the 
spine (+Z, eyeballs-down) is shown in Figure 7.2-38. A modified chart [ref. 4] with ejection seat 
design limits added is illustrated in Figure 7.2-39. 
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Figure 7.2-38. +Z Acceleration Tolerance with Ejection Seat Data Omitted 



Figure 7.2-39. +Z-Human Tolerance Limits showing Ejection Seat Design Limits 
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There are three areas to consider on each chart. The Area of Voluntary Human Exposures is the 
bottom-shaded area. In this region, all exposures were uninjured. For example, a maximum 
acceleration of approximately 14 g could be tolerated (uninjured) for up to 0.04 seconds (40 
milliseconds). The other shaded area at the top of the chart is the Area of Severe Injury. For 
example, acceleration above 100 g for longer than 3 milliseconds produces severe injury. The 
area between the two darkened areas is the Area of Moderate Injury. 

7. 2.6.2 The Dynamic Response Index (DRI) Model 

The most effective human model for early ejection seat design was the DRI described by Stech 
and Payne in 1969 [ref. 5]. This work was performed at what is now called the Wright-Patterson 
Armstrong Aerospace Medical Research Laboratory (AAMRL) and was based on pioneering 
work in human biodynamics by von Gierke [ref. 6], The DRI model was verified by 
comparison with actual ejection seat data (see Figure 7.2-40) by Brinkley [ref. 7]. For many 
years the US Air Force used the lumped mass-spring DRI model and only considered the +Z- 
axis. The DRI model was developed to estimate the probability of spinal fractures for 
accelerations in the pelvis-to-head or +Z direction. In Figure 7.2-40, the abscissa should be 
marked DR+Z as only the +Z component is considered in the DRI. 

The DRI method was generalized by Brinkley to include the other local orthogonal axes (-Z, +X, 
-X, +Y, -Y) [ref. 8], A brief description of the Dynamic Response Method (referred to as the 
Brinkley Dynamic Response Model) follows. 



Figure 7.2-40. DRI+Z Related to Probability of Spinal Injury for Ejection Seats 
(Note that cadaver data was over conservative.) 
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The equations of motion of the human body modeling as a lumped mass are three second-order 
differential equations. Each equation is familiar as simply a forced spring-mass harmonic 
oscillator with damping. The forcing function “A” in Eq. 1 is the measured acceleration along 
each of the three seat axes. As a simplifying condition, the three equations are considered to be 
uncoupled. The second-order differential equation for the Brinkley Dynamic Response model is 
given by Eq. 1 . This equation was given in the Constellation Program (CxP) specification CxP 
70024 Human System Integration Requirements (HSIR) December 2006: 

x + 2 %co n x + a> n 2 x = A EQ. (1) 

where: 

x is the relative acceleration of the dynamic system mass with respect to the accelerometer 
location in the given axis system (X, Y, or Z). 

y is the relative velocity of the mass with respect to the accelerometer location 
in the given axis system. 

x is the deflection of the mass with respect to the critical point in the given axis system. A 
positive value represents compression. 

£, is the damping coefficient ratio. 

to n is the undamped natural frequency of the dynamic system. 

A is the component of the measured acceleration along the specified axis. 

Since the seat axis is not an inertial frame, rotational acceleration must be considered. 


The dynamic response for each axis is given by: 


DR = COn X, S 


EQ. 2 


Where Dynamic Response (DR) (t) is the response of the dynamic system and g is the 
acceleration of gravity. Note that DR is dimensionless. The value “x” when used along the +Z 
axis is the compression of the spine. Note that DR(t) is essentially the normalized response of 
the occupant to the input acceleration in g’s. The maximum value of DR(t) for any axis should 
be less than the limiting value. Thus, DR(t) can be plotted versus the input acceleration time 
history. The maximum of the response DR(t) can be greater or less than the maximum of the 
input acceleration A(t) depending on whether the simple harmonic oscillator amplifies or 
attenuates the driving acceleration. The following values for co n and \ were used: 


NESC Request No.: 06-060-E 


0 

NASA Engineering and Safety Center 
Technical Assessment Report 

Document #: 

NESC-RP- 

06-060 

Version: 

1.0 

Title: 

Crew Exploration Vehicle Integrated Landing System 

Page #: 

93 of 314 


CD nx = 62.8 
COny = 58.0 
COnz = 52.9 
= 0.2 
^y = 0.09 
= 0.224 

Limiting values of DR levels have been set by NASA for the CEV Project and are listed in Table 
7.2-18. These values are also provided in CxP 70024 HSIR. The Very low (nominal) limits 
were derived by Brinkley [ref.9] from studies initiated in the 1980’s for NASA to accommodate 
a “deconditioned” crew member who had been in space for a considerable time. The Low (off 
nominal) DR limit is the same as provided in [ref. 8]. The limits also consider DR levels for 
moderate and high risk [ref. 8], This data is shown in Table 7.2-19. Side restraints raise the 
dynamic response limits for the Y-direction as shown in Table 7.2-19. Note that side restraints 
are not mentioned in the CxP HSIR specification. 

Table 7.2-18. Brinkley Dynamic Response Limits (NASA HSIR Specification for the CEV Project) 


DR level 

X 

(eyeballs out, in) 

Y 

(eyeballs right, left) 

Z 

(eyeballs up, down) 

DR X < 0 

DR X > 0 

DR V < 0 

DR V > 0 

DR Z < 0 

DR Z > 0 

Very low 
(nominal) 

-22.4 

31 

-11.8 

11.8 

-11 

13.1 

Low 

(off-nominal) 

-28 

35 

-14 

14 

-13.4 

15.2 


Table 7.2-19. Dynamic Response Limits from Brinkley and Moser [Ref. 8j 


DR level 

X 

(eyeballs out, in) 

Y 

(eyeballs right, left) 

Z 

(eyeballs up, down) 

DR X < 0 

DR X > 0 

DR V < 0 

DR V > 0 

DR-_ < 0 

DR-_ > 0 

Low (same as 
NASA spec) 

-28 

35 

-14 

14 

-13.4 

15.2 

Moderate 

-35 

40 

-17 

17 

-16.5 

18 

High Risk 

-46 

46 

-22 

22 

-20.4 

22.4 
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Also note that if side restraints are used, the DR levels for Y increase to -15 and +15 (Low), -20 
and +20 (Moderate), and -30 and +30 (High Risk). Caution - These values are not listed in CxP 
70024. 

The limiting value of the DR lim in each axis from Table 7.2-18 is used in Eq. 3 to assess Very 
Low or Low risk. The value of beta, P, in Eq. 3 must be less than one to pass the Brinkley 
Dynamic Response Method criteria for very low or low risk. Note that beta could lag the input 
acceleration in time since the resonant frequencies of the lumped mass system are on the order of 
10 Hz. Consequently, DR should be calculated until the maximum for each direction has been 
identified. 


p 


DR At) 


DR 


lim 


A 2 f 

+ 


J 


DR At) 




K DR > 


lim 


+ 


drA<)' 


DR 


lim 


< 1 EQ. 3 


In the single +Z axis DRI model, the human body was modeled as a single lumped mass with a 
spring and damper representing the spine for Z-direction impacts. Thus DRz (t) is the non- 
dimensionalized response of the lumped mass of the torso to a forced acceleration input along 
the Z-axis. In general for multi-axis accelerations, the linear second-order differential damped 
oscillator given by Eq. 1 is solved independently for each direction. The input acceleration for 
the model should ideally be the acceleration of the seat. For an ejection seat, the primary 
acceleration would be eyeballs down, or in the +Z direction. Note that unlike Apollo where the 
crew was laying on their back in the seat, in a fighter jet the seat would be oriented with the Z- 
axis pointing up. From operational data, the DRI for Z-direction from Eq. 2 was correlated to 
injury using the data shown in Figure 7.2-40. From the chart, most of the maximum DR values 
from operational data ranged from a low of 16 to a high of 20. Any DR greater than 22 or 23 
was correlated to a spinal injury rate above 50 percent. Note that the DR+z limit (DR+ Z hm ) in 
Equation 3, shown in Table 7.2-18 for off nominal in the +Z direction is 15.2, which corresponds 
to an injury probability of less than 1 percent. The DR+z nominal from Table 7.2-20 is 13.1. 
Although the Brinkley Dynamic Response Method model has had success in predicting injury, it 
is a simplified model of a complex dynamic system (i.e., the human body). Also, the method of 
combining the results of accelerations in the X, Y, and Z-directions is not verified as most test 
data were gathered for a single acceleration direction. Insight is obtained by examining the DR 
for each direction before combining the results to obtain Beta in Equation 3. Finally, note that 
the Brinkley Dynamic Response Method model is only used as a predictive tool for injury. It is 
not correlated with fatalities. The threshold for fatalities is difficult to predict. 
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Table 7.2-20. Vertical Velocity and Brinkley Dynamic Response Method Injury Landing Vertical 

Velocity (fps)/Brinkley DRI 



Eyes In/Out 

Spinal 

Sideways 

Low Injury 
Risk 

33 fps/29 

25 f ps/13 

17 fps/9.2 

Medium Injury 
Risk 

42 f ps/35 

29 fps/15.8 

25 f ps/17.4 

High Injury 
Risk 

50 fps/43.9 

33 fps/19.2 

33 fpS/23.2 


In summary, the US Air Force Research Laboratories developed human tolerance models that 
were grounded in previously developed models to assist in the design and evaluation of ejection 
seats. Both human volunteers and ATDs were used along with operational ejection seat data to 
validate these models. The Brinkley Dynamic Response Method is a generalization from +Z 
impacts to impacts in all orthogonal directions. The model has proved to be extremely useful 
and is included in the military specifications for aircraft crew escape systems. 

In contrast to the US Air Force, the US Army developed design guides requiring features such as 
crashworthy cockpits and seats to protect the crew in the event of a “survivable crash” [ref. 10]. 
The automobile industry was faced with Federal regulations to design and build safer cars. 

ATDs with more human impact fidelity such as the Hybrid III were developed as instrumented 
passengers for controlled crash tests. The National Highway Traffic Safety Administration 
(NHTSA) regulates automobile safety and also sponsors research to make automobiles safer. 

The Brinkley Dynamic Response Method is limited in that it uses a simplified mechanical model 
of the human body. In this case the entire body is modeled as a point mass located at the center 
of mass of the human body and attached with a damped spring oscillator with an approximately 
10 Hz resonance frequency. A schematic of the physical layout of the Brinkley model, showing 
the central mass located in the mid-thorax, is shown in Figure 7.2-41. 
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Figure 7.2-41. Central Mass Located in the Mid-Thorax (Brinkley Dynamic Response Method 

Model) 

The nature of the Brinkley Dynamic Response Method model and its representation of the 
human body as a single mass preclude the model from distinguishing relative movement of 
individual body parts. Instead, the human body parts are all modeled as moving together as a 
point mass. While this model works reasonably well for vertical Z-axis loads, such as those of 
an ejection seat, where the major injury location is in the lower spine and the human body moves 
as a unit, it does not properly physically model some other impacts, such as side impacts, where 
sections of the body like the head relative to the body center of mass. In addition to the Brinkley 
Dynamic Response Method model not having the capability to discern different types of injuries, 
the Brinkley model cannot provide insight into the effect of any advanced restraint system that 
provides additional restrictions or protection to the head or other parts of the body. 

The current state of the art does not allow the direct modeling and simulation of a human body 
subjected to injurious high acceleration loading or impact conditions. To address this limitation 
the automotive industry has attempted to generate a relationship between the physical behavior 
of the various ATDs and the human body. This has been attempted via a combination of 
cadaver, sub-injury level testing on human volunteers, animal experimentation, and data 
gathering from actual accidents. The degree to which the ATD simulates the actual behavior of 
the human body is referred to as its “bio-fidelity”. This is a difficult mechanical engineering 
problem and the ATD have gone through an evolution and characterization to improve and 
understand their bio-fidelity. 

The general mechanical difficulty in developing a single three-direction ATD that has adequate 
levels of bio-fidelity has proven to be challenging and has motivated the automotive industry to 
develop a series of ATDs specific to various types of automobile impact conditions. The three 
main types of ATD types of interest are: frontal collision full body motion, rear impact, and side 
impact. For frontal impacts the industry utilizes the Hybrid III ATD as the standard. This ATD 
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has been calibrated with years of test data and is considered a good indicator for whole body 
motion for frontal impact. The HYBRID III, however, is considered to be inadequate for rear 
impacts so the industry has developed a number of rear impact ATDs. The rear impact ATDs 
have more accurate head and neck mechanisms and are better able to predict neck and whiplash 
types of injuries. The Rear Impact Dummy (RID) series of ATDs include RID1, bio-RID, RID2 
and Bio-RIDII. The most important aspects of these ATDs are the additional attention to the 
mobility of the spine particularly in the neck region and also in the area near the hips. The third 
type of ATD is the Side Impact Dummy (SID). The SID’s are similar to the RID’s but with 
additional fidelity for spinal motion in the sideways, Y-axis, direction. To reduce reliance on 
crash testing the industry has developed FEMs of the various ATDs. 

In the present effort, the Hybrid III FEM was selected as the baseline. This is the most 
commonly used ATDs and was thought to be a good starting point for comparing the results 
from the ATDs to those from the Brinkley Dynamic Response Method model. It was also 
thought that the Hybrid III was a reasonable ATD for assessing alternate crew protection 
concepts. It is recognized that for situations such as side and rear impact, models such as the 
SID or RID are more suitable. 

In order to directly relate the results of the FEA simulations (which provide forces and moments 
in strategic locations throughout the model) and actual injury, the nature of specific relevant 
injury, and the forces or moments that produce it must be understood. Both the US Air Force 
and the Navy have active programs in the area of biomechanics and injury potential of ejection 
seats. Much of this work is summarized in a 1993 study entitled “Aircrew Ejection Injury 
Analysis and Trauma Assessment Criteria” published by the University of Michigan 
Transportation Research Institute [ref. 11], This work was commissioned by the US Navy as 
part of an effort to better understand the use of ATDs in the evaluation of escape systems. This 
paper is a survey of the state of the art in understanding the effect of ejection seat g forces on the 
human body. In particular the data indicates that injuries that are experienced at these 
acceleration levels (+ or -Z axis only) are almost always related to injuries of one type or another 
to the spinal column. Serious injuries to soft tissue that are not directly related to impact are 
effectively nonexistent. This fact is important to the CM effort since it indicates that the focus, 
at least in the Z-axis direction, can be primarily on predicting and preventing spinal column 
injuries. 

7.2.6.3 Finite Element Anthropomorphic Test Device (FE ATD) Simulations 

The CM (version 604), Figure 7.2-42 was used to generate vehicle responses so that a 
comparison could be made between injury predictions from the Brinkley Dynamic Response 
Method model and predictions from the FE ATD. To generate the response, the CM was 
oriented in three primary human body directions; eyes in/out (Z-axis), sideways (Y-axis), and the 
spinal (Z-direction). The CM was given an initial velocity just before impact with the ground. 
These orientation exaggerate realistic landing scenarios, however, they provide extreme cases for 
comparing the Brinkley Dynamic Response Method model to the ATD results. 
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a) Seat Attenuation Model b) Seat Attenuation Model 

(Global Coordinate System) (Brinkley Local Coordinate System) 

(Pressure Vessel not Shown) 


Figure 7.2-42. CM 604 Seat Attenuation Model 


LS-DYNA® was used to perform the analysis of the CM impacting ground and resulting 
acceleration profiles were computed and extracted at the location of the crew members’ center of 
mass. The extracted acceleration profiles were then input into the Brinkley Dynamic Response 
Method model and the level of injury was computed using the Brinkley injury criteria. The 
initial impact velocities were adjusted until they corresponding to high, medium and low injury 
risk were identified (refer back to Table 7.2-20). 


Once the impact velocities corresponding to the three levels of Brinkley Dynamic Response 
Method injury were determined and the acceleration profiles were generated (Figures 7.2-43 
through 7.2-54) a separate LS-DYNA® model was created that included only the FE ATD 
constrained in a seat with a five point harness. The acceleration profiles were then applied to the 
seat in this model, simulations were run, and a comparison was made between the Brinkley 
Dynamic Response Method injury criteria and the response extracted from the FE ATD. 
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Figure 7.2-43. Configuration for X A cceieration (eyes in/out DRI) 



Figure 7.2-44. A cceieration Profile for Lo w Eyes In/Out DRI (Vn=33.3 fps) 
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Figure 7.2-45. Acceleration Profile for Moderate Eyes In/Out DRI (Vn=41.67 fps) 
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Figure 7.2-47. Configuration for Y Acceleration (sideways DRI) 



Figure 7.2-48. Acceleration Profile for Low Sideways DRI (Vn=l 6. 66 fps) 
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Figure 7.2-50. Acceleration Profile for High Sideways DRI (Vn= 33.3 fps) 
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Figure 7.2-51. Configuration for Z Acceleration (spine DRI) 



Figure 7.2-52. Acceleration Profile for Low Spine DRI (Vn= 25 fps) 
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Time (sec) 

Figure 7.2-54. Acceleration Profile for High Spine DRI (Vn= 33.3 fps) 

The FE ATD provides a greater amount of information concerning human body response 
including actual motions of the body such as limb flailing, head motion, and loads within the 
body (e.g., acceleration levels at specific locations in the body and forces on individual body 
parts). Figures 7.2-55 through 7.2-62 show details of the Hybrid III ATD and some of the 
locations in the model where data is extracted. Figures 7.2-55 through 7.2.6-57 show the 
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location of where accelerations were extracted in the head, pelvis, and thorax. Accelerations at 
these locations are important since considerable research has been performed and injury criteria 
have been developed that provide correlations between acceleration levels and likelihood of 
injury. Figures 7.2-58 and 7.2-59 depict the lower lumbar region of the FE ATD model and 
where these forces and moments are extracted, while Figures 7.2-60 through 7.2-62 depict the 
neck region and locations where neck forces and moments are extracted. Similarly to the ATD 
accelerations, industry standards have been established that minimize injuries by limiting 
allowable predicted forces and moments in the ATD. 



Figure 7.2-55. Location of Head Acceleration 



Figure 7.2-56. Location of Pelvis Acceleration 
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Figure 7.2-57. Location of Thorax Acceleration 



Figure 7.2-58. Location of Lower Lumbar Spine Force 
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Figure 7.2-59. Location of Lower Lumbar Spine Moment 



Figure 7.2-60. Location of Neck Joints 
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Figure 7.2-61. Location of Upper Neck Moment 



Figure 7.2-62. Location of Lower Neck Moment 

As previously mentioned in this report, it is important to note that many of the industry accepted 
standards have been developed for the automotive industry or ejection seats, and may not be 
directly applicable to the type of conditions and injuries expected for the CM crew members. It 
is also important to note that the FE ATD is an analytical model of the physical simulator, which 
is made up of non-human parts made from materials such as steel, aluminum, rubber, and plastic. 
The FE ATD is designed to predict the response of the physical simulator, which in turn is 
designed to mimic how a human might respond during an actual impact. 
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7.2.6.4 Z-Axis (Spinal) Acceleration Simulations and Results 

Loading in the Z-axis (spinal) direction was examined since this is the loading direction that the 
Brinkley Dynamic Response Method model was originally designed to address and where the 
model is most accurate. Since the results of the Brinkley model are anchored in actual data for 
loading in the spinal direction, it was useful to compare the Brinkley predictions to the results 
generated from the FE ATD and to industry accepted injury criteria. Figure 7.2-63 shows the FE 
ATD in a five-point harness. This harness was used since the five-point harness is the harness 
used for the development of the Brinkley model. The harness was composed of 2 inch nylon 
webbing. The harness was attached to a relatively rigid steel simplified seat and base 
accelerations were applied to the seat in the Z-axis direction (from the pelvis upwards towards 
the head). The commercially available Hybrid III FE ATD model and LS-DYNA® were used to 
generate the transient response. 



Figure 7.2-63. Hybrid III A TD Constrained with Five Point Harness 


Figure 7.2-64 and Table 7.2-21 provide representative output from the LS-DYNA® simulations. 
Figure 7.2.6-28 shows two intermediate time steps from the simulation. The first frame shows 
the maximum head flexion, which occurs just after ground impact, and the second frame shows 
maximum head extension which occurs during the time period where the CM rebounds off of the 
ground. Table 7. 2. 6-4 provides a comparison among the three Brinkley Dynamic Response 
Method injury levels and a collection of injury criteria [ref. 12]. Allowable limits for the injury 
criteria are included in the table and conditions where the limits are exceeded are identified by 
red. 
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Figure 7.2-64. Hybrid III ATD Response at Intermediate Time Steps 


Table 7.2-21. Hybrid III Response and Brinkley Dynamic Response Method Injury Levels Z-Axis 


Criteria 1 

Location 

Allowable 

Brinkley Low 
Injury 

Brinkley Medium 
Injury 

Brinkley High 
Injury 

Head Injury Criteria 
(HIC) 

N# 1 HIC 

700 

3.4 

4.57 

59.54 

Chest Severity Index 
(CSI) 

N# 1787 CSI 

700 

31.6 

43 

64.49 

Thorax G’s 

N# 1787 -resultant 

60 G’s 

46.17 G’s 

75.27 G’s 

127.7 G’s 

Pelvis G’s 

N# 7501 - resultant 


32.7 G’s 

49.42 

41.9 G’s 

Lumbar Force 

JT# 26-37 -resultant 

6672 N 

2804 N 

4037 N 

4545 N 

JT# 38 -resultant 

6672 N 

4080 N 

4500 N 

5500 N 

Lumbar Moment 

JSR# 15 - 


131.4 NM 

143 NM 

124.3 NM 

Neck Force 

JT# 2-5 - resultant 

6806 N 

887 N 

698 N 

1277 N 

Neck Moment Flexion 
(-) 

JSR# 16- 

310 NM 

66.42 NM 

78.6 NM 

79.42 NM 

Neck Moment 
Extension (+) 

JSR# 17- 

135 NM 

108.6 NM 

130 NM 

184 NM 


The Brinkley Dynamic Response Method injury criteria are consistent for low levels of injury in 
that none of the injury criteria allowable are exceeded. For medium Brinkley injury the 
allowable thorax acceleration limit is exceeded, while the remainder of the injury criteria is 
within allowable limits. For high Brinkley injury the thorax acceleration is close to double the 
allowable limit and the neck moment extension allowable limit is exceeded. It is not surprising 
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that the allowable neck moment is exceeded considering the head is not constrained and is 
predicted to undergo considerable motion during impact. It is interesting that the lumbar force is 
within allowable limits for all three Brinkley Dynamic Response Method injury levels 
considering that for this direction of loading spinal cord injuries, particularly in the lumber 
region, are prevalent. 

Many of the automotive injury criteria were developed for frontal impacts where the human body 
rapidly decelerates and body parts such as the head impacts some part of the automobile interior. 
Similarly, aircraft ejection seat criteria are designed for an upright seated pilot being ejected 
vertically through the aircraft canopy where the primary loading is up through the spine. For 
CM nominal landings, the crew members will be seated on their backs and the primary loading 
will be in a direction from the crew member's back towards the chest. Further studies are 
necessary before existing industry accepted injury criteria be used to assess CEV Project crew 
member injury. 

7.2.6.5 Y-Axis (Sideways) Acceleration Simulations and Results 

Results of FEA simulations for the standard five-point harness were compared with simulations 
that contained a variety of lateral supports inspired by a modem race car seat. Modem race car 
seats provide excellent driver protection during impacts that might normally be fatal with a more 
traditional seat design. These seats provide a higher level of protection through the use of lateral 
supports, and head and neck restraint systems, and improved harnesses. A typical modem race 
seat is shown in Figure 7.2-65 alongside the seats from the Apollo Program. The differences in 
lateral support between the two seat designs are evident. Much of the improvements that have 
been realized in race car seats are the results of trial and error combined with results obtained 
during actual operations and accidents. CM seat designs have limited opportunities for 
development tests and therefore must take advantage of improvements in restraint or seat designs 
and subscale test using FE ATDs. 
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Figure 7.2-65. Modern Race Car Seat with Lateral Supports (left) and Apollo CM seats (right) 

The use of lateral supports of the type found in race car seats may not be directly applicable to 
the CEV Project since these seats may be impractical for crew ingress and egress, and for 
stowage during flight. In order for lateral restraints (or any other restraint or crew protection 
system) to be used in space flight applications the system must provide for a practical means for 
ingress, and rapid egress, and stowage when the system is not in use. In addition the restraint 
system must be flexible in its ability to accommodate crew members of different sizes and 
weights. 

In a standard seat such as that used in Apollo CM there is no lateral support other than that 
provided by the harness. There was a slight depression that the crew member sits, but the dish 
shape provided no real restraint during high g Y-axis accelerations. In the case of CEV Project 
CM there is the additional complication of having two distinct decks of seating, with two crew 
members placed in a second row. If permanent lateral restraints are added to the seats, they will 
most likely make it difficult or impossible to get in and out of the seats. 

One system that shows particular promise is a series of side airbags mounted on panels that are 
linked together and can be quickly extended and retracted by the crew for ingress and egress, see 
Figure 7.2-66. The illustration on the left shows the airbag pallets in the extended position and 
the illustration on the right shows the pallets in the stowed position. In this concept there is a 
retractable arrangement of airbags on each side of the individual seats. The airbags are mounted 
so that they pivot about one comer, and there is a mechanical linkage that connects them so that 
they move together as a group. In the up position they are held by a spring clip and by manually 
pushing any one of the airbags down the entire group can be quickly stowed. The airbag position 
can be changed for taller or shorter crew members by using an adjustable length linkage between 
airbag pallets. By adjusting the length of the linkage (Figure 7.2-67) the erect position of the 
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paddle can be pivoted up and down for different crew member sizes. This would allow the 
seating system to be adjusted in flight or on the ground to accommodate changing crew sizes. 



Airbag system deployed Airbag system stowed 

Figure 7.2-66. Airbag Concept shown in a CEV Six-Seat Configuration 



Simulations for impacts in the Y-axis direction were conducted using the Hybrid III FE model, 
harness, and seat as was used for the Z-axis study in the previous section. The purpose of 
performing simulations in the sideways direction was to evaluate the effect of various 
combinations of side impact constraint devices on crew member injury, and to assess the general 
effectiveness of the FE ATD for performing this type of study. The Hybrid III FE ATD is not 
ideally suited for simulating side impacts; however, since this model was already generated for 
the work performed in the previous section it was expedient to re-use the model for side impacts. 
The results presented in this section may not be as accurate as if they had been computed with a 
better-suited ATD such as the SID. However, for performing a first order comparison of the 
effect of side constraints, this model was adequate. 
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Figure 7.2-68 shows the four of the five configurations that were used to assess the effectiveness 
of side impact constraints. The baseline configuration was an unconstrained crew member in the 
five-point harness. The second configuration was comprised of thin pads with a three-inch gap 
between the crew member’s head and shoulders. The third configuration (not shown in the 
figure) was thicker pads with a one-inch gap between the crew member’s head and shoulder. 

The fourth configuration was comprised of thick pads in direct contact with the crew members 
head and shoulders, and the fifth configuration was identical to the fourth with hand and feet 
constraints added to retain the crew member’s arms and legs from significant flaying. For this 
preliminary study the pads properties and thicknesses were not optimized and the results are only 
indicative of overall trends. All of the simulations performed in this section were done using the 
input acceleration profile that generated a high Brinkley Dynamic Response Method injury in the 
sideways direction. 



Unconstrained Thin Pads Thick Pads Thick Pads and Hands 

and Feet Tethered 

Figure 7.2-68. Comparison Among Padded and Constrained Crew Member for Sideways Loading 

Figure 7.2-69 and Table 7.2-22 show the results for the first configuration. Figure 7.2-69 shows 
the ATD response at three intermediate time steps for the model without any side padding. 

Large excursions of the head, arms, and legs are shown during both the initial impact and the 
rebound. The results in Table 7.2-22 agree with the Brinkley Dynamic Response Method 
prediction of high injury considering that four of the seven injury criteria are exceeded including 
the Chest Severity Index (CSI), the thorax maximum allowable g level, and the neck flexion and 
extension. It is important to note that the neck injury criteria are intended for frontal impacts and 
have been loosely applied to the present side impact application. For side impact there are no 
clearly defined neck moment criteria available from industry or defined in CxP specifications. 
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However, the NESC team felt that the industry frontal impact neck criteria could be reasonably 
applied, as an approximation, to side impacts. Additional study of neck injury criteria is required 
before firm criteria can be established by the CxP. 



Initial Conditions Initial Impact Rebound 

Figure 7.2-69. Hybrid III A TD Response at Intermediate Time Steps for Side Impact (No Side 

Padding) 


Figure 7.2-70 and Table 7.2-22 show the results for the second configuration. This type of 
support is similar, in concept, to what is currently used for race car seat side supports, and has 
been proven highly successful in reducing injury during relatively violent high-speed race car 
crashes and was thought to have similar benefits for CM crew members also undergoing side 
impact loadings. Figure 7.2-70 shows the ATD response at three intermediate time steps for the 
model with thin side padding. The large excursions of the head, arms, and legs that were seen 
for the configuration without side padding is eliminated with the thin pad configuration. 
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Table 7.2-22. Comparison Among ATD Configurations Using Input Acceleration Profile that 
Produces High Brinkley Dynamic Response Method Injury in Lateral (Sideways) Direction 



Allowable 

Five Point Harness* 

Thin pads 

Thicker pads 
1” gap 

Thick pads 

Thick Pads 
and hand 
and Feet 
Constraints 

HIC 

(Nodal) 

700 

225 

4050 

256 

174 

92 

CSI 

(Nad* 1787) 

700 

965 

1960 

1965 

1211 

1559 

Thorax g's 

(Nod® 1787 Altered @1 80 Hz) 

60 g's 

78 g’s 

90 g’s 

62 g’s 

71 g’s 

81 g's 

Pelvis g's 

(Nod* 7501 filtered @180Hz) 

130 g’s 

90 g’s 

120 g’s 

90 g’s 

161 g’s 

126 g’s 

Nack force 

(Max JT2-5 filtered @1 8GHz) 

6806 N 

3950 N 

3500 N 

3950 N 

3264 N 

3283 N 

N«ck morrrentftexlon 
(Max +JSR1 7 phi. theta. psi 
filtered @18GHz) 

310 Nm Ai 

315 Nm 

165 Nm 

142 Nm 

123 Nm 

84 Nm 

Nack mo men tax tension 
(Max -hlSRI 7 phi. thata. psi 
filtered @18GHz) 

135 Nm** 

180 Nm 

130 Nm 

125 Nm 

132 Nm 

96 Nm 


* All configurations utilize five point harness 
** Frontal impact crleria used for lateral direction 


The results in Table 7.2-22 show that the thin side pads help to reduce the neck moments, which 
was expected since the side pads prevent the head from bending over. However, the Head Injury 
Criteria (HIC), CSI, thorax, and pelvis acceleration criteria all exceed their allowable limits and 
are considerably larger than for the configuration without any pads. These results were also 
expected since the crew member head and chest impact into the relatively thin and stiff pads 
leading to short durations of large accelerations. 




Initial Conditions Initial Impact Rebound 


Figure 7.2- 70. Hybrid III A TD Response at Intermediate Time Steps for Side Impact (Thin Side 

Padding) 
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The configuration with the thicker pads and one-inch gap between the pads and head and chest 
provides a higher level of injury protection than the previous two cases. For this configuration, 
only the CSI and the thorax maximum allowable acceleration were exceeded. The thicker pads 
provide so much reduction in head acceleration that the head injury criterion is reduced by an 
order of magnitude over the configuration with thin pads. For the thick pad configuration where 
the pads are in contact with the head and shoulders, the head injury criteria and the CSI are 
further reduced. However; the pelvis acceleration is increased and is beyond the allowable limit. 
For the thick pads and constrained arm and leg configuration, all of the observed injury criteria 
are reduced compared to the other configurations except for the CSI and the thorax acceleration. 
Both of these criteria exceed their allowable limits. 

In general, introduction of the side supports eliminates the large head excursion and neck 
hyperextension. Neck hyperextensions are the main cause of severe injury for the case without 
lateral support, so it appears promising that lateral support will improve survivability for Y-axis 
direction impact. However, the body must still mitigate the crash, so while neck forces are 
reduced due to reduced head and neck extension, other body forces and moments may show 
increases. This is supported by the fact that padding had the effect of reducing the neck moment 
while increasing the CSI. The key design goal is to keep any individual force, moment or 
acceleration from exceeding the allowable injury level, which will require tradeoffs in the 
design. With further design improvements it may be possible to reduce the chest and thorax 
loadings to within allowable limits; however, for the designs that were considered, both the 
Brinkley Dynamic Response Method model and the FE ATD predicted high levels of injury. 

A significant difference between the Brinkley Dynamic Response Method model and the FE 
ATD is that the Brinkley model cannot directly determine the effects of adding constraints such 
as side padding while the FE ATD can simulate somewhat realistically the distributed motion of 
the body and predict accelerations and loads at discrete body locations. Furthermore, the 
Brinkley model only predicts the level of injury, not the injury location or type. The FE ATD 
provides a major advantage over the Brinkley model in that the ATD may be used to assess the 
effects of different seat designs, constraint systems, helmets, and crew protection systems. 

7. 2.6.6 X-Axis (chest in/out) Acceleration Simulations and Results 

A comparison between the Brinkley Dynamic Response Method model and the FE ATD was 
made in the X-axis direction using an applied acceleration profile obtained from a maximum 
drag abort situation. This situation occurs when an emergency occurs during ascent and the CM 
must be separated from the launch vehicle using the Launch Abort System (LAS). When the 
LAS is activated, the crew members are pushed into their seat backs. Once the LAS rocket’s 
fuel is depleted the aerodynamic drag reverses the acceleration on the crew members and they 
are pulled out of their seats in the opposite direction. The Hybrid III FE ATD is probably most 
suited for loadings in the X-axis direction since this is the direction where the ATD was 
originally designed for automotive frontal impacts. The acceleration profile for the maximum 
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drag abort and the corresponding FE ATD response at intermediate time steps is shown in 
Figures 7.2-71 and 7.2-72, respectively. 

As expected, during LAS rocket firing the crew member is pushed into their seat and there is 
minimal motion of the head, arms, or legs. In the later stage when aerodynamic drag is dominant 
and the crew member is pulled out of his seat, both the head and arms and legs are extended 
leading to the potential for larger neck forces and head accelerations. Note, this particular model 
contained overly stiff elbow joints which explains the limited extension of the arms. 

Additionally, flailing of the arms and legs in the close confines of CM could be an issue since the 
arms and legs may impact surrounding structures or strike other crew members. To compensate 
for flailing, hand and foot restraints will be an important design consideration. The large head 
movement could also be an issue and some type of head/helmet constraint may be required. 
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Initial Conditions Large Abort System Aerodynamic Drag 

Rocket Firing 

Figure 7.2-72. Hybrid III ATD Response at Intermediate Time Steps for Maximum Drag Abort 

Figure 7.2-73 shows the maximum drag abort acceleration that was applied to the crew member 
seat along with the resulting Brinkley Dynamic Response Method and the FE ATD response in 
the X-axis direction. Both the Brinkley and the ATD response follow, reasonably close, both the 
input acceleration shape and magnitude. The Brinkley response closely tracks the input 
acceleration profde during the rocket-firing phase then oscillates about the input acceleration 
during the aerodynamic drag phase. The Brinkley model employs an approximately 10 Hz 
oscillator, so it is expected that the response after the load reversal would oscillate and that the 
oscillations would be near 10 Hz. The maximum Brinkley dynamic response is 20 g, which is 
within the Brinkley low risk of injury range for X-axis (chest in/out) accelerations. The FE ATD 
response is within the same general range as the Brinkley response except for numerous short 
duration acceleration spikes through the transient response. The ATD response has been filtered 
to eliminate response above 180 Hz and further reductions, or elimination, of at least some of 
these acceleration spikes could be minimized by adding more damping to the ATD model, and 
model refinement through the inclusion of a higher fidelity seat model and seat padding. Even 
with these outlying acceleration peaks, the computed CSI is below the allowable limit (212 < 
700) leading to a consistent result with the Brinkley Dynamic Response Method prediction of a 
low probability of injury. 
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Figure 7.2-73. Acceleration Profile for Maximum Drag Abort, Brinkley Dynamic Response Method 

and FE A TD Chest A cceleration 

1. 2.6.7 Applicability of FE ATDs 

The FE ATD used in conjunction with the Brinkley Dynamic Response Method provides a 
useful set of tools for predicting potential crew injuries during CM landings. In addition these 
tools enable the design and evaluation of alternate crew protection systems. Specifically: 

• The Brinkley Dynamic Response Method reasonably ensures an acceptable environment 
for crew members in a five point harness. However, it has limited ability to provide 
insight into additional or modified crew restraint and protection systems. The Brinkley 
model has been modified to include the general effect of sideways crew member support. 
However, the Brinkley Model does not distinguish between types of support or their 
differences in effectiveness in preventing injury. 

• FE analysis and ATD tests are capable of providing insight into alternate crew member 
injury protection systems. The FEA model and the physical ATDs can be used to assess 
the effects of variations of restraint and support in a comparative manner and if validated 
with human response data, can provide quantitative assessments of crew injuries. 

• Additional evaluation of industry standard injury criteria should be initiated to ascertain 
the applicability of these criteria to crew member protection. 

• Practical methods for implementing additional crew protection appears viable and should 
be further developed. 
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$.0 Findings and Recommendations 

The Findings and NESC Recommendations first for the Phase I and Phase II portions of this 

study are presented. 

8.1 Phase I - Comparison of 604, TS-LRS001, and Apollo LRS 

8.1.1 Findings / Observations for Phase I - Comparison of 604, TS-LRS001, and Apollo 
LRS 

Note: This material was extracted from Appendix A, which represents the only documentation of 

Phase I. Pertinent sections of this appendix were brought forward into the body of this report. 

F-l. C2 (LM 604) - Retrorocket Extraction - Design susceptible to retrorocket/capsule 
contact and damage during extraction, especially under high body-rate conditions: 

• Risk of damage to radar antennas, retrorocket body/nozzles, and other components 
mounted near the CM apex. 

• Risk of severing pyro firing lines, radar avionics to antenna RF transmission lines, 
and parachute risers. 

• Extraction failure would result in failure of main chute to deploy properly due to 
series connection between the two subsystems. 

• Mars lander heritage benefits toward concept feasibility not applicable due to 
utilization of rate-limiting devices to lower the lander from confluence rockets after 
chute inflation. 

F-2. C3 (LM 604) - C3 - Winds and Residual Horizontal Velocity - Insufficient data has 
been produced to demonstrate that not including horizontal retrorockets in the design is 
viable. 

• Operational limit of 3 1 fps is too close to CM limits for crew safety and is relatively 
low; DSNE requirement > 45 fps. 

• Consequences of CM rollover are not well understood and could be potentially 
severe. 

Without horizontal velocity abatement, crew safety is critically dependent on the 
accuracy of a 3 -hour weather forecast. 

• If weather forecast was 99.9 percent accurate, still non-trivial risk for possible 
rollover and threat to crew safety. 

Use of horizontal retrorockets on the TS-LRS001 is not risk free. 

• Mars lander experience is that performance dispersions and failure modes with 
horizontal retrorockets have potential to compound the problem. 
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F3: C4 (LM 604 and TS-LRS-001) - Retrorocket Firing Chain - Applicable to both 

baselines. Dispersions on retrorocket bum completion conditions have potential to cause 
load limits to be exceeded. 

• Difficult to control performance using high-impulse solids to deliver the CM to near- 
zero velocity near the ground. 

• Small knowledge errors in parameters such as thrust profile, altitude/velocity state, 
and attitude/rate state may lead to late firing, including impact prior to ignition. 

Retrorocket firing time critically dependent on accuracy of altitude and velocity sensors. 

The LM 604 radar antenna location on the retrorocket pack may result in degraded 
accuracy with potential to degrade ignition time calculations. 

F-4. Cl (LM 604) - Main Chute Extraction - Use of a single drogue to extract all main 

chutes in the current design involves rigging the mains together in a way where hang-up 
of a single chute has the potential to fail the extraction of all the others resulting in LOC. 

F-5. C5 (LM 604 and TS-LRS-001) - Apex/FBC Separation - Post separation impact with 
CM has potential to cause severe damage: 

• Current design is based on Apollo heritage of separation thrusters and pilot parachute. 

• The Apollo Program was only able to provide limited satisfaction in meeting the 
requirements of no re-contact, even after extensive work. 

F-6. C6 (LM 604) - Retrorocket Plume Impingement - Exhaust plume may be swept into 
riser lines or across the top of the capsule potentially resulting in safety related damage. 

F-7. C7 (LM 604 and TS-LRS-001) CM Orientation Event - Dispersions in ability to orient 
the CM correctly for touchdown may result in unacceptable crew loads: 

• Unclear if dynamics due to issues such as swivel friction, parachute dynamics, hang 
angle, and available thruster torque are acceptable. 

• Not yet demonstrated acceptable Y-axis (cross spine) accelerations for all crew 
members. 

F-8. C8 (LM 604) - Drogue Stabilization - During a pad abort scenario, timeline may be 
insufficient to detect a failed drogue to allow deployment of the back-up drogue: 

• Residual attitude and rates, potentially high due to pad abort, may hamper 
deployment of main chutes. 

• Detection scheme for failed drogue is unclear. 

F-9. C9 (TS-LRS-001) - Impact Survivability - The TS-LRS001 baseline could sustain 

impact or puncture from ground terrain that may damage critical aft bay components and 
pose safety risk and/or egress hazard. 
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• Tanks and unfired retrorockets may be vulnerable to puncture due to jettison of heat 
shield which would have served as a protective barrier 

The LM604 retrorocket pack may re-contact the capsule and pose safety risk 

• Retrorockets (used or unspent) may damage up-righting devices, location aids, or 
egress hatch. 

F-10. CIO (TS-LRS-001) - Heat Shield Separation - Potential for heat shield contact and 
damage of retrorocket nozzles on pad abort scenarios: 

• Mars lander heritage heat shield separation technique had low clearance margins at 
high attitude rates. 

Radar may track heat shield for up to 1,300 feet after separation and may prevent timely 
lockup on ground for an on pad abort scenario. 

8.1.2 NESC Recommendations for Phase I - Comparison of 604, TS-LRS001, and Apollo 
LRS 

R-l. C2 (LM 604) - Retrorocket Extraction - If the retrorocket system is to remain as part of 
the Project baseline, then utilize ejection mechanisms or other deployment aids; increase 
volume available to this system in the forward bay in order to accommodate devices. 

(ID 

• Consider strong design bias toward storing (and therefore deploying) retrorocket in an 
upright position in the forward bay in order to minimize deployment complexity. 

• Consider placement of retrorockets in location that does not require dynamic 
deployment. 

However, the NESC team strongly recommends that the Apollo parachute architecture be 
used since it is better understood and characterized based on its heritage. 

R-2. C3 (LM 604, TS-LRS-001) - Winds and Residual Horizontal Velocity - Conduct forecast 
reliability study. (F-2) 

• Wind speeds restrictions may need to be reduced below 31 fps to reduce the risk of an 
incorrect forecast. 

• Evaluate whether the CxP paradigm of having at least (1 of 6) sites available still 
holds with more stringent wind forecast restrictions. 

• Implement LRS architecture that restricts landings to low winds, but design CM to be 
more tolerant to winds. 

• Decision not to use retrorockets for pad abort is inconsistent with NESC Land versus 
Water Assessment recommendation to preserve land-landing and ensure crew safety. 

• Perform thorough analysis of the LM 604 retrorocket firing dynamics to understand 
potential impact of further aggravating horizontal velocity situation. Conduct study 
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of the TR-LRS001 regarding performance dispersions on horizontal retrorockets, 
consider limiting use to high winds. 

R-3. C4 (LM 604 and TS-LRS-001) - Retrorocket Firing Chain - Perform error budget 
analysis, and chose ignition altitude and proper retrorocket sizing to ensure proper 
touchdown conditions across range of dispersions. (F-3) 

• Verify that CM impact attenuation system capable of absorbing dispersions in an 
acceptable manner. 

• Consider sustainer retrorocket bum, thrust tailoring, or thrust termination techniques. 

• Develop requirements for radar (or equivalent) as soon as possible. 

• Ensure proper field of view for sensor elements. 

• Consider use of retrorockets for pad abort to avoid crew injury for contingency land- 
landing scenarios. 

R-4. Cl (LM 604) - Main Chute Extraction Recommendation - Consider independent 
extraction for each of the main canopies. (F-4) 

R-5. C5 (LM 604 and TS-LRS-001) - Apex Cover Separation - Design separation scheme to 

ensure that cover will clear capsule without contact, and then be laterally translated out of 
wake flow. (F-5) 

• If a pilot chute is required, consider a time delay method in mortar firing to allow it to 
clear the docking tunnel. 

• Conduct study to determine possible safety risks to ground crew and civilian 
population. 

R-6. C6 (LM 604) - Retrorocket Plume Impingement - Conduct exhaustive plume analysis, 
including acoustics, and determine adequacy of separation distance between capsule and 
retrorockets. (F-6) 

• Verify adequacy of riser attachment locations relative to the retrorocket nozzles 

• Consider adding requisite retrorocket plume protective devices for riser lines and 
exposed components on forward deck. 

R-7. C7 (LM 604 and TS-LRS-001) CM Orientation Event - Accelerate modeling efforts and 
testing to define system design requirements in this area. (F-7) 

R-8. C8 (LM 604) - Drogue Stabilization - Revisit Apollo Program heritage data. (F-8) 

• Dual drogue deployment is not materially more susceptible to deployment 
entanglement than single drogue system. 

• Consider parallel drogue deployment at divergent angles consistent with the heritage 
Apollo parachute subsystem design. 
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R-9. C9 (TS-LRS-001) - Impact Survivability - Consider protective structural elements to 
mitigate risk of impact to aft-bay or consequences of retaining heat shield. (F-9) 

• Consider design of protective elements that allow for “high” horizontal velocity, even 
with use of horizontal retrorockets. 

• Consider method to safe unfired pyros at time of touchdown. 

R-10. CIO (TS-LRS-001) - Heat shield Separation - Increase energy in separation devices to be 
robust to high attitude rates. (F-10) 

• Add protection bumpers or other guards near retrorocket nozzle locations and 
consider heat shield lockup scenario when selecting altimetry architecture. 

8.2 Phase II - Integrated LRS Risk Assessment 

The Findings, Observations, and NESC Recommendations for each of the six Phase II tasks are 
presented. 

8.2.1 Task 1: Entry, Descent, and Landing System Quantitative Risk Assessment 
Findings, Observations, and NESC Recommendations 

8.2. 1.1 Task 1 Findings and Observations 

F-l. The 606 design uses parachutes to make sure that the FBC is out of the way for drogue 
parachute deployment. Parachute system reliability is a risk driver and having a 
requirement for such a system significantly increases the risk to the CM. 

F-2. Task 3 of this assessment presented the predictability of horizontal winds at the landing 
site poses some risk in that the CMs horizontal landing speed could be exceeded due to 
mispredicted winds, potentially contributing to an increased PLOC. 

F-3. The landing systems may experience reduced capability due to failures. 

8.2.1.2 Task 1 NESC Recommendations 

R-l. Improved FBC Release (Apex cover) - Ensure the FBC will not interfere with drogue 

chute deployment with adequate reliability (i.e., without parachutes) and prevents CM re- 
contact (including main parachutes). (F-l) 

R-2. Increased Horizontal Velocity Attenuation - Protect against unpredicted high horizontal 
winds / gusts. (F-2) 

• Horizontal velocity attenuation or increased CM capability will reduce the main risk 
driver for land landing systems, and provide margins that could be used to increase 
stability of the CM during landing. 

R-3. Improved Occupant Protection - Improve crew protection as a functional redundancy for 
landing system faults (e.g., heat shield separation, retrorockets, airbags, etc.). (F-3) 
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• Risk analysis has shown that active landing attenuation systems are susceptible to 
failure. Improved protection for the crew provides additional safeguards for 
unforeseen failure modes that may occur. 

8.2.2 Task 2: Landing System T&V Data Analysis 

8.2.2. 1 Task 2 Findings 

F-4. Logical evolution of early test plans in place for parachute and airbag subsystems will 

likely result in a robust T&V strategy for design certification of those individual 
subsystems: 

• Current focus is on early developmental testing to understand design space, not on 
long-term T&V planning. 

• Early developmental testing strategy appears to be robust and well conceived. 

F-5. Further investigation is warranted in the area of integrated LRS evaluation: 

• Unclear to as to which Orion Project element (either NASA or LM) has been charged 
with evaluating end-to-end LRS performance, including interactions between 
subsystems and environments. 

• Current plans to evaluate end-to-end performance of LRS are dependent on the 
utilization of a few major flight test opportunities (e.g., PA-1, AA-1, etc.). 

o Although these flight tests are valuable, they will not provide enough 

opportunities to exercise integrated LRS system under expected range of dynamic 
conditions. 

o Unclear if Orion Project has plans to add additional flight-like test opportunities 
dedicated toward evaluation of integrated, end-to-end LRS performance. 

8.2.2.2 Task 2 NESC Recommendations 

R-4. Explicitly add a test program to exercise end-to-end performance of LRS with emphasis 
on interactions between subsystems: (F-4 and F-5) 

• Utilize air drops of LRS and CM hardware with flight realistic geometry and 
performance characteristics. 

• Executed across a wide range of dynamic conditions bounding expected attitudes, 
rates, and winds for nominal and abort landings to demonstrate system design 
margins. 

• Coupled to an integrated performance modeling task to extend the number of cases 
that can be evaluated. 

R-5. Formulate a working group charged with the responsibility for verification of end-to-end 
LRS performance with emphasis on subsystem-to-subsystem and subsystem-to-CM 
interactions. (F-4 and F-5) 
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R-6. Adopt a strategy of developing specific LRS tests based on evaluation and verification 

needs as opposed to forcing the verification plan to conform to already existing “all 

encompassing” tests. (F-4 and F-5) 

R-7. T&V Scenario for FBC Release: (F-4 and F-5) 

• Ensure that FBC can separate without striking and damaging forward bay 
components. 

• Ensure that FBC does not come back and strike capsule at a later time. 

• Ensure that FBC release does not induce adverse attitude rates on capsule that may 
affect downstream events such as parachute deployment. 

R-8. T&V Scenario for Parachute Extraction and Deployment: (F-4 and F-5) 

• Ensure that capsule attitude, rates, physical configuration, and operating 
characteristics do not interfere in any way with chute extraction and deployment 

• Ensure that drogue parachute can stabilize capsule. 

• Ensure that capsule and components on upper deck can still function after exposure to 
parachute opening loads. 

• Ensure that parachute deployment chain of events does not result in adverse attitude 
or rates affecting downstream events. 

• Ensure that each component of the LRS satisfies its design requirements. 

R-9. T&V Scenario for heat shield Jettison (if required): (F-4 and F-5) 

• Ensure that heat shield can separate without striking and damaging aft bay 
components. 

• Ensure that heat shield does not come back and strike the capsule at a later time. 

• Ensure that the jettisoned heat shield does not interfere with downstream events such 
as radar acquisition of the ground. 

R-10. T&V Scenario for Parachute Descent: (F-4 and F-5) 

• Ensure that capsule attitude and dynamics under parachute does not result in adverse 
conditions for landing. 

• Ensure that RCS thruster firings are effective in orienting capsule 

• Ensure that RCS thruster firings and/or venting of residual gasses does not damage or 
degrade the parachute or airbag materials. 

R-ll. T&V Scenario for Airbag Inflation (if required): (F-4 and F-5) 

• Ensure that airbags can be extracted and inflated without damaging components in the 
aft bay 
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• Ensure that the inflated airbags do not interfere with other component functions in the 
aft bay and vice versa. 

R-12. T&V Scenario for Landing and Impact (for water or land): (F-4 and F-5) 

• Ensure that impact loads are handled properly by entire end-to-end attenuation chain 
(e.g., airbags, structure, crew couch, and suit). 

• Ensure that impact does not compromise structural integrity. 

• Ensure that parachute dynamics during landing and impact process do not result in 
unexpected and adverse consequences. 

• Determine through test and analysis system performance in off- nominal and failure 
case conditions. 

8.2.3 Task 3: Landing Site Accessibility and Availability Data Analysis Findings, 
Observations, and NESC Recommendations 

8.2.3. 1 Findings 

F-6. The CxP’s land-landing site network provides high degree of physical access. 

F-7. 14 percent reduction in L/D results in 25 percent to 30 percent loss of individual site 

access. 

F-8. Raise maneuvers enable a significant portion of network access: 

• 50 percent for L/D of 0.35, 85 percent for L/D of 0.30. 

• Raise required for docking module disposal - otherwise, SM deorbit would be 
preferred. 

F-9. Night restrictions will reduce access and create periodic network gaps. 

F-10. Separation between landing opportunities for ISS missions is generally measured in days: 

• Requires treating each access as a unique opportunity. 

• ISS support missions unlikely to undock without high probability of deorbit. 

F-ll. No obvious CONUS land sites to support return from 28.5 degree orbits assuming no 
delta-v available from SM. 

F-12. The SLAAM tool allows the weather (primarily horizontal winds and gusts) to be 
included to show effects on landing opportunities. 

8.2.3.2 NESC Recommendations 

R-13. Implement forecasting tools and procedures at each candidate land-landing to ensure 
capability is understood when operations are required. (F-6 through F-12) 
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R-14. Consider implementing additional crew protection in anticipation of misforecast of 
landing site winds / gusts. (F-6 through F-12) 

R-15. Evaluate supplemental contingency crew protection as a means of avoiding operationally 
over constraining wind placards in the near term. (F-7, F-8) 

R-16. Develop a test program that can accommodate ISS support schedules and be prepared to 
capitalize on performance envelope expansion opportunities as they emerge. (F-7, F-ll) 

R-17. Select water based landing location that takes advantage of ascending and descending 
pass opportunities. (F-7, F-ll) 

8.2.4 Task 4: CM Roll Control in Preparation for Landing Data Analysis Finding and 
NESC Recommendation 

8.2.4. 1 Task 4 Finding 

F-13. Program tests show that the CEV Project CM RCS has sufficient torque to meet the +30 
degree roll requirement with current parachute harness / riser designs. 

8.2.4.2 Task 4 NESC Recommendation 

R-18. Endorsed the use of roll control: (F-13) 

• Some form of roll control is useful to orient the vehicle Z plane with the direction of 
travel to maximize crew safety 

• Limited cabin volume and minimal human impact acceleration tolerance in the Y axis 
(lateral impacts) 

• During water-landings the CM can be oriented to minimize crew impact 
accelerations, which supports meeting reduced impact acceleration requirements for 
de-conditioned crew. 

8.2.5 Task 5: Parachute Release Times during Land-Landing Findings and NESC 
Recommendation 

8.2.5.1 Findings 

F-14. For landing conditions where there is a horizontal wind, retaining the parachutes has a 
detrimental effect on CM stability since the drag force on the parachutes can pull the 
vehicle over. 

F-15. The effect of rigging and parachute flexibility has minimal effect on the acceleration and 
roll response so that the trends reported should be applicable to most parachute system 
designs. 

8.2.5.2 Task 5 NESC Recommendation 

R-19. Require an automated parachute release system. (F-14 and F-15) 
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• An automated system is required since the release may be required to occur within 
0.50 seconds of touchdown, which is not enough time for a crew operated manual 
release. 

• An automated release system would be a critical function which must ensure no 
unplanned release. 

8.2.6 Task 6: Crew Protection System Enhancements Data Analysis Findings and NESC 
Recommendations 

8.2.6.1 Findings 

F-16. The FEA modeling approach shows promise as a tool for seat designers. 

F-17. In addition to developing tools, it is important that a practical mean exist for 
implementing these design solutions. 

F-18. The Brinkley Dynamic Response Method criteria define an acceptable environment for 
crews restrained in a specific way. It does not provide insight into additional or modified 
crew restraint systems. 

8.2.6.2 Recommendations 

R-20. Development and adoption of contemporary design tools and techniques is necessary. 
(F-16) 

• The Brinkley Dynamic Response Method criteria define an acceptable environment 
for crews restrained in a specific way. It does not provide insight into additional or 
modified crew restraint systems. 

• Use of FEA and ATD tests allow designers to evaluate the effectiveness of alternate 
restraint systems. 

R-21. Assuming that the potential for unplanned landings on land cannot be eliminated for a 
CM configured for water penetration or other compromised landing configurations, 
additional emergency crew protection is highly desirable. ( F-l 7) 

R-23. Develop practical methods for implementing additional crew protection appear realistic 
and should be developed (e.g., lateral support). (F-l 7) 

9.0 Alternat e Viewpoints 

There were no alternate viewpoints. 

10.0 Other Deliverables 

There were no other deliverables. 

11.0 Lessons Learned 

There were no lessons learned. 
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12.0 Definition of Terms 

Corrective Actions Changes to design processes, work instructions, workmanship practices, 
training, inspections, tests, procedures, specifications, drawings, tools, 
equipment, facilities, resources, or material that result in preventing, 
minimizing, or limiting the potential for recurrence of a problem. 

Finding A conclusion based on facts established by the investigating authority. 

Lessons Learned Knowledge or understanding gained by experience. The experience may 
be positive, as in a successful test or mission, or negative, as in a mishap 
or failure. A lesson must be significant in that it has real or assumed 
impact on operations; valid in that it is factually and technically correct; 
and applicable in that it identifies a specific design, process, or decision 
that reduces or limits the potential for failures and mishaps, or reinforces a 
positive result. 


Observation A factor, event, or circumstance identified during the assessment that did 

not contribute to the problem, but if left uncorrected has the potential to 
cause a mishap, injury, or increase the severity should a mishap occur. 
Alternatively, an observation could be a positive acknowledgement of a 
Center/Program/Project/Organization’s operational structure, tools, and/or 
support provided. 


Problem 


The subject of the independent technical assessment. 


Proximate Cause The event(s) that occurred, including any condition(s) that existed 
immediately before the undesired outcome, directly resulted in its 
occurrence and, if eliminated or modified, would have prevented the 
undesired outcome. 


Recommendation An action identified by the NESC to correct a root cause or deficiency 

identified during the investigation. The recommendations may be used by 
the responsible Center/Program/Project/Organization in the preparation of 
a corrective action plan. 

Root Cause One of multiple factors (events, conditions, or organizational factors) that 

contributed to or created the proximate cause and subsequent undesired 
outcome and, if eliminated or modified, would have prevented the 
undesired outcome. Typically, multiple root causes contribute to an 
undesired outcome. 
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13.0 Acr onyms List 

AAMRL 

Armstrong Aerospace Medical Research Laboratory 

AFB 

Air Force Base 

ATD 

Anthropomorphic Test Devices 

CEV 

Crew Exploration Vehicle 

CEVPO 

CEV Project Office 

CM 

Crew Module 

CSI 

Chest Severity Index 

CxP 

Constellation Program 

DR 

Dynamic Response 

DRI 

Dynamic Response Index 

FBC 

Forward Bay Cover 

FEA 

Finite Element Analysis 

GEM 

Government Equipment and Materials 

GN&C 

Guidance Navigation and Control 

HSIR 

Human System Integration Requirements 

JPL 

Jet Propulsion Lab 

L/D 

Lift to Drag Ratio 

LAS 

Launch Abort System 

LEO 

Low Earth Orbit 

LM 

Lockheed Martin 

LOC 

Loss of Crew 

LRS 

Landing and Recovery System 

MMOD 

Micro Meteoroid Orbital Debris 

NESC 

NASA Engineering and Safety Center 

NM 

Nautical Miles 

NO A A 

National Oceanic and Atmospheric Administration 

NRB 

NESC Review Board 

PDR 

Preliminary Design Review 

PLOC 

Probability of Loss of Crew 

RAC-3 

Requirements Analysis Cycle-3 

RCS 

Reaction Control System 

RID 

Rear Impact Dummy 

RTE 

Return to Earth 

SID 

Side Impact Dummy 

SLAAM 

Spacecraft Landing Accessibility and Availability Model 

SM 

Service Module 

STK 

Satellite Toolkit 

T&V 

Test and Verification 

TIM 

Technical Interchange Meeting 

ZBV 

Zero Based Vehicle 
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Volume II Appendices 

Appendix A. Crew Exploration Vehicle Integrated Landing and Recovery Evaluation 
Appendix B. Task 2 T&V Assessment 

Appendix C. Task 1 Integrated Entry, Descent and Landing Risk Matrix 
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Appendix A. Crew Exploration Vehicle Integrated Landing and 

Recovery Evaluation 



06-060-E 

Crew Exploration Vehicle Integrated 
Landing and Recovery Evaluation 
(Phase f. 604 vs. TS-LRS001) 


John Baker 
Wayne Lee 
7 December 2006 


This briefing is for status only and does not represent complete engineering data analysis 
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Agenda 



• Team Composition 

• Task Charter and Assumptions 

• Executive Summary 

• Background information on Evaluated Configurations 

• Methodology of Approach 

• Detailed Discussion of Concerns 

• Summary 


This briefing is for status onty and does not represent complete engineering data analysis 
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Task Objectives and Assumptions 



• Objective was to assess TS-LRS001 and 604 designs for the 
CEV landing system with respect to risk factors potentially 
leading to severe injury or loss of crew 


• Focus was on reliability; mass, volume, cost, complexity were 
secondary considerations unless obvious concern existed 


• RAC-3 (requirements analysis cycle) results not yet factored 
because task was run in parallel with RAC-3 activities 


* Assessment relied on existing design and performance data 
from NASA and LM CEV teams; insufficient time for 
independent analysis 

• Due to the early stage of development, insufficient detail exists 
for a numerical risk analysis or reliability calculation; two 
designs compared qualitatively for risk concerns 


This briefing is for status only and does not represent complete engineering data analysis 
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TS-LRS001 




2 drogues deployed in 
parallel 

3 parachutes extracted by 
independent pilots 

Vertical base-mounted retro 
rockets 

Released heat shield 

Horizontal propulsion with 
four rockets - meets DSNE 
wind requirements 

Toe-in hang angle of 1 5° 

Crush able structure 
exposed by heat shield 
release 

Altimeter antennas mounted 
under heat shield 



604 


1 prime drogue, backup 
deployed if prime failed 

4 parachutes extracted 
simultaneously by drogue 

Vertical retro at chute confluence 
on risers above capsule, single 
gas generator 

Retained, but unlocked heat 
shield 

No horizontal propulsion - does 
not meet DSNE wind 
requirements 

Toe-in hang angle of 20° 

Crushable structure compressed 
by heat shield upon landing 

Altimeter antennas mounted to 
confluence rocket casing 





This briefing is for status only and does not represent complete engineering data analysis 
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Architecture Comparison with Apollo 



Feature Apulia 604 TS-LRS0G1 

Parachue 


Drouge Chute 

Z deployed in parallel via mortars 

1 prime via mortar, backup 
drogue deployed if FSW detects 
crime has failed 

Z deployed In parallel via mortars 

Main Chutes 

3 rinq sails, 83. S' diameter 

4 rinq sails 

3 rinq sails, 1ZZ.G' diameter 

Main Deployment 

Extracted by 3 independent 
moitar-Fined pilots 

Extracted simultaneously by 
sinqle droque 

Extracted by 3 independent 
mortar-fired pilots 


HeatsMetd 


Type 

Avooat 

PICA 

PICA 

Retain merit 

Retained for splashdown, load 
path same as for entry 

Retained for touchdown, but 
unlocked from entry load path 
prior to touchdown 

letttisoned after main chute 
deployment 


Terminal Descent ACS 

Type 

Passive 

Active orientation required, uses 

Active orientation required, swivel 

swivel at chute confluence 

TBD 


Radar 


Altimetry 

M/A 

(TBD) Radar 

(TBD) Radar or LIDAR 

Velocimetry 

M/A 

(TBD) Doppler or GPS 

(TED) Doppler or GPS 

Avonlcs Location 

M/A 

Within capsule 

Within capsule 

Antenna Location 

M/A 

At chute confluence, mounted to 
retrorocket caslnq 

At bottom of capsule, under the 
heats Meld 


Retrorockets 


Vertical 

M/A 

1 racket w/ 6 nozzles, (TBD) 
thrust 

4 rockets, 7000 lbs thrust each 

Horizontal 

M/A 

N/A 

4 nockets, 940G lbs thrust each 

Mounting Location 

M/A 

On risers, at parachute confluence 
point above capsule 

At base of capsule, under the 
heats hield 


This briefing is for status only and does not represent complete engineering data analysis 
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Executive Summary 



• Confluence retrorocket pack is viable, but will require extensive 
development and validation program 


- Primary concerns include deployment without contacting crew 
module, rocket plume impingement, and retro recontact after 
touchdown 


- Base mounted system preferred to reduce implementation risks, 
but may result in slight increase in risk at impact if heatshield 
jettison option is chosen 

* Current state-of-the-art techniques for pyrotechnic safe and 
inhibits can reliably prevent premature heatshield separation 

- Reliability of planned heatshield separation is not a discriminator 
between the two design concepts 

• Insufficient data has been produced to demonstrate that not 
including horizontal rockets, and relying on operational wind 
limits, is a viable design option 


This briefing is for status only and does not represent complete engineering data analysis 
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Executive Summary (cont.) 



* Reliability and robustness of apex cover separation and CM 
clearance system needs to be improved 


• Use of single extraction device for all main chutes viewed as 
potential single point failure 

- Recommend each main chute be independently deployed 

* No obvious safety related discriminators found in the use of 3 vs. 
4 main chutes 


This briefing is for status onty and does not represent complete engineering data analysis 
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Evaluation Paradigm 



* EDL (post-entry) decomposed into 5 major sequences all of 
which must succeed 


- Parachute deploy sequence 

- Heatshield unlock or jettison sequence 

- Terminal descent sequence 

- Retrorocket firing sequence 

- Touchdown 


* Each sequence was further decomposed into set of sub-events 
or conditions, all of which must succeed in order for the 
sequence to be successful 

* Each sub-event was evaluated for design vulnerabilities with 
the potential to cause severe injury or loss of crew 


This briefing is for status onty and does not represent complete engineering data analysis 
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Evaluation Paradigm (cont.) 



• Design vulnerabilities considered in the qualitative evaluation 
process include: 


- Brittleness (sensitivity to design assumptions) of performance to 
flight dynamics, environmental factors, or operating conditions 

- Potential to be a common cause failure source or susceptibility to 
a common cause failure 


- Lack of redundancy coupled with potential reliability issues 

- Steep drop off in performance under off-nominal conditions 

• Color code assigned to each sub-event based on level of 
concern relative to the above list of vulnerabilities 


This briefing is for status onty and does not represent complete engineering data analysis 


10 


NESC Request No.: 06-060-E 



This briefing is for status onty and does not represent complete engineering data analysis 


11 


NESC Request No.: 06-060-E 


@ 

NASA Engineering and Safety Center 
Technical Assessment Report 

Document #: 

NESC-RP- 

06-060 

Version: 

1.0 

Title: 

Crew Exploration Vehicle Integrated Landing System 

Page #: 

146 of 314 





TS-LRS0G1 events H Colon ar* for »xampl* ©Q4 events 

only 


Low concern ; function deemed to be robust 

Moderate concern; design concept may be adequate but 
robustness improvements should still be considered 

Active concern; recommend proactive measures to increase 
robustness and/or change design 

Function not applicable to the design 


{') Concern colors assigned per sub^wenl under the assumption that ell 
previous sub-events and sequences are successful 


This briefing is for status only and does not represent complete engineering data analysis 
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Vulnerability Concern Map 


Landing 
Sue cessful 




Parachute 

Deploy 


No premature depflcy 
during entry 


Drogue fires. deploys, 
and fcuietes dearty 


Drogue critics 

•capsuie 


Phot dii^toi deploy 
and inflate cJearslv 


Heatshield 

Sep/Unlock 


Terminal 

Descent 


Retro rocket 
Firing 

C4 

Touchdown 

Event 

i 

i 

1 



l 

No premature wp or 
UL dunhg entry 


Far«ti(Ap pnjvWes 
adequate drag 


PSW commands firing 
at proper time 

Residual vertical 
velocity within limits 

Release pyree fire 


Rad ar provides 


Petros ignite upon 


nds within 

successfully 


accurate data 

04 

eomnrortd 


b i tf limits 1 

Sop or UL devices 


IM Up provide accurate 


Horiz Ignite upon 


Rocduai 

settle 


d&fle 


COTnrnfir'MJ 


.1hmhrr.it: 

H5 separate-, and no 


RCSthrustora orient 


Capsule and crow 


Structure and crow 

recontact 

CIO 

capsule correctly 

C7 

survive rocket bum 

CS 

survive impact 



Mams inflate and 
survive opening loads 


Reims survive 
opening loads 


Left half of box is colored 
with concern code for 
TS-LRS0Q1 events 


$ ufo -a vont or tonal mn 
that must succeed 


("| Colors are far example 

only 


Right halT of box is colored 
with concern code TorC04 
events 

Documented concern 
number 


This briefing is for status only and does not represent complete engineering data analysis 
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Cl - Main Chute Extraction 



* Concerns (604) 


- Use of a single drogue to extract all main chutes in current design 
involves rigging the mains together in a way where hang-up of a 
single chute has the potential to fail the extraction of all the others 


• Recommendations (604) 

- Consider independent extraction for each of the main canopies 


This briefing is for status onty and does not represent complete engineering data analysis 
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C2 - Retrorocket Extraction 



• Concerns (604) 

- Design susceptible to rocket/capsule 
contact and damage during extraction, 
especially under high-rate conditions 

• Risk of damage to radar antennas, rocket 
body/nozzles, and other components mounted 
near apex of vehicle 

* Risk of severing pyro firing lines and radar 
avionics to antenna RF transmission lines 

- Extraction failure may result in failure of 
main chute to deploy properly due to series 
connection between the two subsystems 

- Mars heritage benefits toward concept 
feasibility not applicable due to utilization of 
rate-limiting devices to slowly lower Mars 
lander away from confluence rockets after 
chute inflation 



This briefing is for status only and does not represent complete engineering data analysis 
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C2 - Retrorocket Extraction (cont.) 



• Recommendations (604) 


- Utilize ejection mechanisms or other deployment aids; increase 
volume available to this system in the forward bay in order to 
accommodate devices 


- Consider strong design bias toward storing (and therefore 
deploying) retrorocket in an upright position in the forward bay in 
order to minimize deployment complexity 

- Consider placement of retrorockets in location that does not 
require dynamic deployment 

- Evaluate scope and schedule implications for test and verification 
program; likely to be both extensive and expensive 


This briefing is for status onty and does not represent complete engineering data analysis 
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C3 - Winds & Residual Horiz. Velocity 



* Concerns (604) 


- Insufficient data has been produced to demonstrate that not 
including horizontal rockets in the design is viable 

• Operational limits of 31 ft/s (18 knots) is too close to vehicle limits for 
crew safety and is relatively low; DSNE requirement > 45 fps 

• Consequences of roll over are not well understood and will be 
potentially severe 

- Without horizontal velocity abatement, crew safety critically 
dependent on accuracy of 3-hour weather forecast 

• If weather forecast was 99.9% accurate, still non-trivial risk for possible 
roll over and threat to crew safety 

- (TS-LRS001 ) Use of horizontal rockets is not risk free 

• Mars experience is that performance dispersions and failure modes 
with horizontal rockets have potential to compound problem 


This briefing is for status only and does not represent complete engineering data analysis 
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C3 - Winds and Horiz. Velocity (cont.) 



• Recommendations (Both) 


- Conduct forecast reliability study 

• Wind speeds restrictions may need to be reduced below 31 ft/s in order 
to reduce risk of incorrect forecast 

• Evaluate whether paradigm of having at least 1 (out of 6) sites available 
still holds with more stringent wind forecast restrictions 

- Implement LRS architecture that restricts landings to low winds, 
but design capsule to be more tolerant to winds 

• Decision not to use retros for pad abort is inconsistent with NESC 
Land vs. Water study recommendation to preserve land landing 

- (604) Perform thorough analysis of retro firing dynamics to 
understand potential impact of further aggravating horizontal 
velocity situation 

- (TR-LRS001) Conduct study regarding performance dispersions on 
horizontal retrorockets, consider limiting use to high winds 


This briefing is for status only and does not represent complete engineering data analysis 
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C4 - Retrorocket Firing Chain 



• Concerns (Both) 


- Dispersions on retro burn completion conditions have potential to 
cause load limits to be exceeded 


* Difficult to control performance using high-impulse solids to deliver 
vehicle to near-zero velocity near the ground 

■ Small knowledge errors in parameters such as thrust profile, 

altitude/velocity state, and attitude/rate state may lead to late firing, 
including impact prior to ignition 

- Retro firing time critically dependent on accuracy of altitude and 
velocity sensors, but viable device not yet selected 


• NESC understanding is that work is underway on this topic 

- (604) Radar antenna location on retro pack may result in degraded 
accuracy with potential to spoof ignition time calculation 

• Degradation due to antenna cant angle precluding nadir view of ground 


This briefing is for status only and does not represent complete engineering data analysis 



Confluence Point 
Retro Firing 
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C4 - Retrorocket Firing Chain (cont.) 



• Recommendations (Both) 


- Perform error budget analysis, and chose ignition altitude and 
proper rocket sizing to ensure proper touchdown conditions 
across range of dispersions 

- Verify that capsule impact attenuation system capable of 
absorbing dispersions in an acceptable manner 

- Consider sustainer rocket burn, thrust tailoring or thrust 
termination techniques 

- Develop requirements for radar (or equivalent) as soon as possible 

- Ensure proper field of view for sensor elements 

- Consider use of retros for pad abort to avoid hard impact for land 
landings 


This briefing is for status onty and does not represent complete engineering data analysis 
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C5 - Apex Cover Separation 



• Concerns (Both) 


- Post separation impact with vehicle has 
potential to cause severe damage 

■ Current design is based on Apollo heritage of 
separation thrusters and pilot parachute 

• Apollo team was only able to provide limited 
satisfaction in meeting the requirements of no 
re-contact, even after extensive work 

• Recommendations (Both) 

- Design separation scheme to ensure that 
cover will clear capsule without contact, and 
then be laterally translated out of wake flow 

- If a pilot chute is required, consider a simple 
time delay method in mortar firing to allow it 
to clear the docking tunnel first 

- Conduct study to determine possible safety 
risks to ground crew and civilian population 



This briefing is for status onty and does not represent complete engineering data analysis 
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C6 - Plume Impingement 



* Concerns (604) 

- Exhaust plume may be swept into riser lines or 
across the top of the capsule potentially resulting 
in safety related damage 

• Recommendations (604) 

- Conduct exhaustive plume analysis, including 
acoustics, and determine adequacy of separation 
distance between capsule and retrorockets 



Plume impi nge mem; during test Of 
IAARS System 


- Verify adequacy of riser attachment locations 
relative to the rocket nozzles 


- Consider adding requisite protective devices for 
riser lines and exposed components on forward 
deck 


This briefing is for status onty and does not represent complete engineering data analysis 
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C7 - Capsule Orientation Event 



* Concern (Both) 


- Dispersions in ability to orient capsule correctly for touchdown 
may result in unacceptable loads on crew 

• Unclear if dynamics due to issues such as swivel friction, parachute 
dynamics, hang angle and available thruster torque are acceptable 

• Not yet demonstrated acceptable y-axis (cross spine) accelerations for 
all six astronauts 


* Recommendations (Both) 

- Accelerate modeling efforts and testing to define system design 
requirements in this area 


This briefing is for status onty and does not represent complete engineering data analysis 
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C8 - Drogue Stabilization 



* Concerns (604) 


- During a pad abort scenario, timeline may be insufficient to detect 
a failed drogue and then deploy the back-up drogue 

• Residual attitude and rates, potentially high due to pad abort, may 
hamper deployment of main chutes 

• Detection scheme for failed drogue is also unclear 

* Recommendations (604) 


- Revisit Apollo heritage data 

• NESC team opinion is that dual drogue deployment is not materially 
more susceptible to deployment entanglement than single drogue 
system 

- Consider parallel drogue deployment at divergent angles 


This briefing is for status onty and does not represent complete engineering data analysis 
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C9 - Impact Survivability 



• Concerns 


- (TS-LRS001) Impact or puncture from rocks may damage 
critical aft bay components and pose safety risk and/or 
egress hazard 

■ Tanks and unfired rockets may be vulnerable to puncture due to 
jettison of heatshield which would have served as protective 
barrier 

- (604) Retro pack may fall onto top of capsule and pose 
safety risk 

• Unspent retros (> 200 lbs) on water landing, or spent retros, may 
damage uprighting devices, location aids, or egress hatch 

• Recommendations (TS-LRS001) 

- Consider protective structural elements to mitigate risk of 
impact to aft-bay or consequences of retaining heatshield 

- Consider design of protective elements that allow for “high” 
horizontal velocity, even with use of horizontal rockets 


IMPACT DAMAGE TO CM Of 1 
DURM3 IBODEGF&E TEST AT 
HORIZONTAL VELOCITY OF 56 FPS 



Damage to tankage in 
imi&area 


- Consider method to safe unfired pyros at time of touchdown 


This briefing is for status only and does not represent complete engineering data analysis 
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CIO - Heats hield Separation 



• Concerns (TS-LRS001) 


- Potential for heatshield contact and damage of retrorocket nozzles 
on pad abort scenarios 

• Mars heritage heatshield separation technique have had low clearance 
margins at high attitude rates 

- Radar may track heatshield for up to 400 meters after separation 
and may prevent timely lockup on ground on pad abort scenario 


* Recommendations (TS-LRS001) 


— Increase energy in separation devices to be robust to high attitude 
rates 


- Add protection bumpers or other guards near rocket nozzle 
locations 


- Carefully consider heatshield lockup scenario when selecting 
altimetry architecture 


This briefing is for status only and does not represent complete engineering data analysis 
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Summary 



• Confluence retrorocket pack is viable, but will require extensive 
development and validation program 


• Safety of heatshield separation is not a discriminator between 
the two design concepts 


* Insufficient data has been produced to demonstrate that not 
including horizontal rockets, and relying on operational wind 
limits, is a viable design option 


* Robustness of apex cover separation scheme should be 
improved 

* Use of a single drogue to extract all main chutes is a potential 
single-point failure 


This briefing is for status only and does not represent complete engineering data analysis 
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Appendix B. Task 2 T&V Assessment 



Test and Verification Task Update - Orion LRS 

( 06 - 060 - E) 


Phil Glynn 
Christian De Jong 
Wayne Lee 
Jerry McCullough 
Chester Ong 
Bob West 
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Background 


• Purpose of task is to provide an independent assessment to the Orion project as to the 
set of activities that would comprise a complete T&V plan for EDL 

• Project will be able to utilize the assessment as a guide during their task planning 
process 

• Historically, T&V plans are not developed until the PDR time frame or after, but 
experience has demonstrated that early T&V planning can reduce overall risk 

- Reliability and seope/cost growth risk may be reduced if T&V assessment uncovers activities 
not previously identified 

- Design and schedule risk may be reduced if T&V assessment uncovers aspects of design that are 
difficult to verify 

• Early work on T&V planning can be problematic due to lack of firm design 
requirements 

- T&V planning is further complicated by the fact that verification that all written requirements 
have been satisfied never leads to a complete verification story 

• This task will utilize event-tree methodology to expose the items that must be verified in 
the absence of requirements 




This briefing is for status onty and does not repfesent complete engineering data analysis 
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Background (conk) 


* Although EDL design for Orion will be unique, historical experience can be used to 
recommend verification activities because concepts under consideration have been used 
either on Apollo or at Mars 




This briefing is for status onty and does not repfesent complete engineering data analysis 
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Verification Assumptions 


• Different types of verification exist 

1, Conducting activities to determine whether requirements make sense and that a concept is 
feasible 

2. Conducting activities to corroborate that the presumed external conditions encountered during 
flight are valid 

3* Conducting activities to determine whether the chosen design instantiation can withstand 
encountered flight environments 

4. Conducting activities to be certain that the chosen design instantiation has met its functional 
pe rfo rm anee requirements 

5. Conducting activities to determine that the quality of a delivered flight article is such that it can 
be flown 

6. Conducting activities to ensure that simulation tools used for all of the above produce valid 
results 




This briefing is for status onty and does not repfesent complete engineering data analysis 
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Verification Assumptions (cont.) 

* Although all types of verification are important, this task will primarily address type #4 

* Verification types #2 and #3 will be addressed to the extent that the environments are 
central to the functional performance of the EDL hardware 

- Example*) include aerodynamics, aero thermal, and winds 

- But not EMI/EMC, radiation, vibrations, etc. 
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Event Tree Methodology 



• The event tree is a hierarchical method of functionally decomposing EDL into events 
and enumerating all the successful conditions required for “success” 

- Utilized by the Mars program because it was deemed not practical to enumerate EDL success 
using requirements 

• EDL is first exapnded into major phases 

- Each phase is a regime of flight differentiated from the others based on similarity of the 
governing mode of motion 

- Pre-entry, Entry, Parachute Deployment, Parachute Descent, Landing 

• Each phase is expanded into sequences 

- Sc qu en ces a re h ig h-1 e v el f u n c ti o n s of t he veh icle that ty p k a 1 ly re q u i re se v era I s u bsy s te m s 
working together to accomplish 

- Drogue deploy, heatshkld separation, landing set-up, etc. 


This briefing is for status onty and does not repfesent complete engineering data analysis 
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Methodology (cont.) 


* Each sequence is expanded into discrete events 

- Events are typically subsystems performing a specific action 

- Canopy inflation, mortar firing, th ruster firing, etc 

* Each event is expanded into a set of conditions, all of which much succeed, in order for 
the event to succeed 

- For example, for pilot mortar firing, a required condition is that the parachute pack must be 
ejected at the proper velocity 

- In the absence of form al requirements, these conditions form a set of de facto requirements 

- Conditions are qualitative because design has not been finalized 




This briefing is for status onty and does not repfesent complete engineering data analysis 
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Preliminary Event Tree Expansion 



Phase 

Sequence 

Event 

Condi lions 

Varffl cation Activities 
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(B) Oiociue serta 1 deployment test 
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Chute pack survives snatch load 

(B) Drogue aerial deployment test 
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Capsule and crew tolerant to mortar reaction loads and 
related d ynamlcs 

(6) frugue ejection shades and toads transference analysis 
(A) Drogue election shocks and toads transference test 
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Drogues open and achieves Full Inflation under expected 
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(If) Drogue aerial deployment test 

2017 




Drogues survive opening loads 

(B) Drogue aervs 1 deployment test 

2018 




Capsule and crew tolerant to drogue opening toads and 
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(6) Drogue tedatlon chocks and loads transference analysis 
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Preliminary Event Tree Expansion 




Sequence 

Event 

Condition! 

Verification ActiviEiei 

P PT w 
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Oronue Separation 
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Preliminary Event Tree Expansion 



Phase 

Sequence 

Event 

Conditions 

Venhcation Activities 

PFT # 




CM and mw tolerant to pilot snatch and opening toads and 
related dynamics 
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(ft) High fidelity terminal descent multi body attitude dynamics 
analysis 

tRJ Par a thuta/Ca tirade InLnradton 

5049 


hHttociri 







HUttfiUd Rfctabsi 







Reter*! on device atUvrrtton oorrannnd sent at proper time 

(ft) Intrgrated avionics test hod and Right eoftvwire mqrnutoe liming 
herl 

60S0 




Return loti device activates Lirorr command 

(B.Aj Retention device porlta ma rice and tliaractnU'flUon Cast 

605.1 




Sc^J dnvfcra actuate uni knpait [EsIriTl vi’lnctly 

(A) Sep tfcvlbft mmpnncnt performance and diarantm Dalinn U-d 

(B) Mea bshield separation analysis 

(R) Full state iTritelitold « pi. ratten tent 

6052 


This briefing is for status onty and does not repfesent complete engineering data analysis 


NESC Request No.: 06-060-E 


0 

NASA Engineering and Safety Center 
Technical Assessment Report 

Document #: 

NESC-RP- 

06-060 

Version: 

1.0 

Title: 

Crew Exploration Vehicle Integrated Landing System 

Page #: 

173 of 314 



Preliminary Event Tree Expansion 



Piiate 

Sequence 

Event 

Conditions 

Verification Activities 

PPT s 




CM and crew toternr* to release torces and related dynamics 

[ b) Heatshleld shocks and toads transference ana lysis 
f A> IfeaMiirtd shocks and tutor; tramftirttalM lest 

6053 



HenLrfitold Seporntton 







Hr-alshtofcl r.lr'.ins aipnilc wibwjut cnnlnct 

[A) Sop dnvice cDfiiflfHiem [rirfarmaace and duuact etlffllton test 
£b) frDUF heatshtold separation analysis 
(ft) full ucflle hr.rt mutton npUltlfin test 
[ft) full scale dynamical aerial separation test 

SOM 




1 hMljJw'Jtl 1 II' “r tVttf hum H^pztule wiU i rid ‘.u'liMNiuiinl 
recwtact, «n(l niovn; tor enough (iws y within the albcjftiecl 
tlun to [xc? ltirk L (pound rHHtadria iiltilrlrMniHje 

(b) HeabhlekVtrtdilcIa trajectory analysis 
[ ft.fi) 1 Fui scale hrmtdilelcE sorwrahcni test. 

6055 


t.MUllliri i'l H‘|l 







JU'iri™ MoublUHi 







Alt/rel nwoi; cpmmonded to ncHva te at the pn>u* lane 

[ ft) Intespated avionics lesft; b«l and Might software sequence Hmlng 
1r-:i 

7056 




«t/vel sensors achieve unambiguous lock on the around 
iftiltiln allocator! Ifnir 

lb) Radar characterization field lest 

[bl Riii Lir ran Ion nance dinrautnrLottkMi LiJjor atEHiy list 

7057 



Sensot Operation 







All/m.4 sensors gertarali: dp lit Uutl in’rfc ncniBacy 
recjnfr entente hi the presence or terrain effects and capsule 

dTilarnlLfi 

(B.AJ totdbr [iuniKhel/allon fleU Inst 

[b.A] Radar performance characterization 1 a bora tor y test, 

f n> Modeled ■ actor ixm forrtianee simulation 

7058 



Roll Oilentalton Sotod 

Jon 






C>r*G computes direction of horficwi tel motion and selects 
npproflrttfe landing attitude 

[b) Aigarltfim/iwftwiire test bed 

(ft) Gompmohondvo EDI hajwtory and dynamics tirmiitetinuf. 

{ R) Integrated Svloii£S tost bed and lllglrt software sequence InrOt 

70J0 



r 1 II Filing 







Thrwtet Oring command sent at proper time 

(&) Intespated nvbnico test bed and night softwme sequence Hmlng 
lr-:rf 

70*0 




1 hr idler ISP and thrust properties are as eipected 

(b) ACS Ihrtrter chMadeflzadon and perfornunce test stand ill Inga 

7061 




Ho adverse plume Impingement dlecte on CM 

[B) Qipsule plume Impingement and vehicle configuration analysis 
(ft) ACS liwiEter diaiitL-lerljalipn MnJ |rf1cn manor 1 trit ^tniil IIiIiej-k 
{ R) Tlineitei /taosulo liileracUea test firing 

7D62 




Resultant torque on vehicle Is as expected. Including effects 
It OcM llnilu ife-Hi 

(b) High fidelity terminal descent attitude dynamics analysis 
[A) IhrusterfcaEHulMlser Interaction trail 

7063 




GFK control bale performs correctly In targeting and 
achieving final attitude conditions 

[B) Algor Idtm/software test bed 

[b) High Ikdefcty teinitoni descent attitude dynamics analysis 
{ ft) Integrated avionics test bed and flight software sequence test 

7Md 



TrKwer Computation 







GMC computes correct aftltude/tknc to inflate alrbog& 

(B) Algor W"ii/soflwnre test IhcI 

(b) Comprelrensl ve EDI, trajectory and dynamics simulations 
(ft) Integrated avionics test bed and flight software sequence test 

7D bS 




GMC computes correct ■Mttudrf/tfcne to Fire horiiontal 
rackets 

(b) a|go*1rtmr/Kiftwa re lest bed 

{ b) Comprehend ve £DL trajectory and dynamics simulations 
£ ft) Integrated avionics test bed and flight software sequence test 

70*6 


This briefing is for status onty and does not repfesent complete engineering data analysis 
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Preliminary Event Tree Expansion 



PhlSe 

Sequence 

Event 

CdrditiAnl 

Verification Activities 

PPT ff 



Alilirna TkT lallon 







Hu ten bun release command sent at proper time 

( B) Integrated a vionics test bed and Flight software sequence tin iHk] 
tretl 

7067 




Retenlksa dev loe actuated upon command 

i B.Al Retention device performance Hindi characterization test 

7063 




b™ 

(J!) tnti-xjfaled avfcmks li=J bod and 1 Until aoltwnrn sequence liming 
test 

7069 




Inllatrm cfcrvk.’n hirillr^v ch acSlvdlis; unon ciHrmiand 

(C.Al Inllalian dfiflu HffHmUKfi arid LtiaiUclia (ration tost 

7070 




All hags ill Id desired level ol pressure wlUilu altoated time 

(B) Airbag inflation test 

7071 




Airbeds maintain proper pressure level until ground impact 
ts achieved 

(B) Airbag Inflation and leak test 

mi 




CK and crew totei ant Id loads and dynamics associated *tth 

(B) Airbag shocks and loads transference analysis 

7073 


GHC Activity 







Sensor Operation 







EDI sensors otnentir omirrtir data vitmn subjected bn 
forces and dynamical transients during chute descent phase 

(fi) EMu performance ctuKacterlyratlon tost 
(DO IMU performance choracterf radon analysts 
(15) Hnclnr performance charnctarlraMon ffeW test 
f«) Radar performance characterlraHon analysis 

8074 



Stain Propntinllon 







Attitude and posy vet states propagated or estimated 
co noddy when tubjednl forces and dynamical transients 
riirliq diutn rftUCTsnt plHisft 

(H) Integrate avionics test bed and flight software sequence test 
(0) Ajoor d hm^oFtware lest bed 

(.K) Parachute descent phase dynamics characterization test 

8075 

LiindirtB 







Terminal DecetanUoit 







Horizontal Velocity Re 

ductlon 






Horizontal rockets comma ntted ta Ignite at Die proper Ume 

(15) [integrated avionics test bed and Night son ware sequence timing 
r,.-r 

9070 




i- m* J ignite upon command 

(15) Horizontal mrkel 1 perto urn- stand 

flrlnos 

9077 




Hartrantal rocket thrust and ISP p*ofik> are as expected 

(.6) Horizontal rocket characterl radon and performnnce lest stand 
firings 

9073 




dorUonbil rockets decetorate capsule to velocity Ibnto; prior 
to Impact 

<K) farachute/capsiAe horizontal rocket interaction flnng tost 
(B) Capsule response dynamics analysis 

9079 




Post-bum atHturt? and rates wlthm tolerance 

(ft) fcarachuteycapsiAe horizontal rocket biter notion firing tosl 

9000 




CM and crew tolerant to loads nod dynamics associated wRh 
■nckrt burn 

(A) Horizontal rocketfcnpsule Interaction test Iking 

(15) [horizontal racket IhIehj shocks and bjtcfc Irainfernncn nnafyaM 

9001 




Mo ad verso plume Impinijomivit n-Ttrcfci on CM 

(15) CHpquta plurnn Iniplngenrifil and vrhldi; mariigurallori nnaly.'ifc; 
( B) Horizonte 1 rocket characterization and performance test stand 
Nilngs 

(R) Horizontal racket/capsule biter action test fir log 

9005 


Tcnchdo wn 







AlilkK) Ormatlon 







AliUuj sittolee capability and performance as expected 

(15, A) AhImij '.tkiiHH.D-ii/.jti.fii 1 kji ■■ iU lin j Usi 
(B) Airbag pressure and stroke arwlysls 

JUB3 


Th 

te fvrieifiwi Le f f^r 

Alitugs -rented at Ifte proper tun: 

(B) biiigrnted avionics test bed and flight soRwuro sequraicn timing 
test 

(B) Staiuur character IraUon and q uni flea tton test 

(B.A.) Connoted laboratery venting test 

(R) Airbag pariotrnancu characterization drop test 

liU AirUmnbzsn i >nr.in£h+Sil W rt nMHafc 

1 134 
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Preliminary Event Tree Expansion 




Sequence 

Event 

Conditions 

Verification Activities 

PPT B 




AritjaijS Integrity i nit ttwnfMOmlMHl Eiy Interaction with 
terra Hi 

[15} AMvnj terrain Inter adion drop lest 
[15} Airbag materials quakticaddn test 
[15) L jritfimj situ Invest kiadon 

lies 



impact Attenuation 







dew s™i1 iisi.tinlnt aid oltolu ■ capatillly and performance 
as expected 

(t5) Crew seal and loads Impact analyst* 
(15) Crew seat laboratory loads test 
(A) High (Unity capsule imparl teal 

list. 




load' linn sni Hod to crew diet to impact fc os r-ipeclnd 

[ B) (antfcrTj lrtipi»cl load ljnn*nikz-ioii analysis 

[A) II hall hdefity capsule Impact teal 

1187 




Post ■ Impnct aUltudr slid rates* arc as i-ipnlid 

( B) Impart tlynnnic analysis; 

(E.A) He* Itdelllv b ltd no dynamics test 

1188 




Capsule maintains appropriate structural Integrity and 
unoonsumed voiatltes not reused 

(B> Impact bads and dynamics analysis 
{B r A} High lidullt y capsule Impact lest 

1189 




Ground and terrain characteristics are as expected 

(B) iandrxi site terrain survey 

1190 




Wind speeds at die dme or landing are as expected 

(15) Historical wind (precast rellabdlty analysis 

1191 
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Identification of Verification Activities 


• Each condition is evaluated to determine a recommended set of verification activities 
(test, simulation, analysis) to prove that the condition is satisfied 

• For each activity, the following will be recommended 

- A brief, qualitative description of the activity 

- Whether the activity should cover exhaustive, bounding, or representative scenarios 

- External variables that should be varied 

- Fidelity of the interfaces to other subsystems or components that interact with the prime target 
of verification 

• Collection of activity descriptions will form the nucleus of the delivered product 




This briefing is for status onty and does not repfesent complete engineering data analysis 
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Forward Bay Cover Release 


This briefing is for status only and does not represent complete engineering data analysis 
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1001: Retention release command sent at proper time 



• Element Description 

- Retention release command sent at proper time 

* Untimely retention release may result in subsequent chute stages inflating at improper M Q/AOA. 


• Verification Approach 

- Integrated avionics test bed and flight software sequence timing test 

* Test requires execution of flight software on tlight-tike avionics using simulated GNC sensor data to mimic 
response of vehicle to dynamical environment. 

* Will verify that proper timing of issued commands are not subject to hardware to software timing issues. 

* Should be run across a bounding set of cases representing the extremes of dynamics encountered by the vehicle. 


This briefing is for status only and does not represent complete engineering data analysis 
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1002 : Retention device command 



* Element Description 

- Retention device actuated upon command 

* Failure to operate the retention device will result in cover retention and failure to release deploy parachute 
system* 


* Verification Approach 

- Retention device performance and characterization test 

♦ Test involves operating the retention release device in a controlled setting to verify that release occurs in a 
reliable fashion. 

• A sufficient number of trials is needed to gain statistical confidence and should be executed across a bounding 
set of conditions such as temperature and pre-load. 


This briefing is for status onty and does not represent complete engineering data analysis 
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1003: Cover sep devices 



* Element Description 

- Sep devices actuate and imparl desired velocity 

* Failure in the sep devices will result in cover retention and failure to release deploy parachute system. 


• Verification Approach 

- Sep device component performance and characterization test 

* Test involves operating the separation device in a controlled setting to verify that release energy meets 
specification. 

* A sufficient number of trials needed to gain statistical confidence should be executed across bounding set of 
conditions such as temperature and pre-load. 

- Forward bay cover separation analysis 

* Activity involves use of a dynamical simulation capable of modeling objects of arbitrary shape, their motion due 
to relative forces, and whether contact occurs. 

* Cases should be run for an exhaustive set of conditions including variations in separation device performance 
and initial altitude and rales of the capsule, 

* Model of separation device used in the simulation will be calibrated by the device characterization test. 

- Full stale forward bay cover separation test 

* Test involves firing a flight- like separation device on a full-scale mock-up of the forward cover attached to a 
mock-up of the upper cone area of the capsule in a controlled setting. 

* Only need to execute several limes under representative conditions to confirm validity of the simulation 


This briefing is for status only and does not represent complete engineering data analysis 
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1004: Forward cover release loads and dynamics 


* Element Description 

- CM anti crew tolerant to release forces anti related dynamics 

* Structural damage and injury to crew may result from higher then expected cover release loads and associated 

dynamics. 




* Verification Approach 

- Forward bay cover release shocks and loads transference analysis 

* Activity involves an analysts to determine that the amount of attenuation of shock and loads generated from 
release of the forward bay cover, as transferred through the structure, results in acceptable level seen at the 
attach points for critical components and the crew. 

- Forward bay cover release shocks and loads transference test 

* Test involves measurement of forward bay cover release shock and loads on a flight-like structure at critical 
attachment points along the structure, 

* Only need to execute a few representative cases to both confirm the validity of the shock transfer analysis, and 
to gather accelerometer data to calibrate the structural attenuation model used in the analysis 


This briefing is for status onty and does not represent complete engineering data analysis 
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Forward Bay Cover Separation 


This briefing is for status only and does not represent complete engineering data analysis 
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1005: Cover near term recontact (1/2) 



* Element Description 

- Co ve r c I ea r s ca p s u le w it h o u t con ta ct 

* The cover contacting in the near term may impair future drogue chute deployment. 


• Verification Approach 

- Sep device component performance and characterization test 

* Test involves operating the separation device in a controlled setting to verify that release energy meets 
specification. 

* A sufficient number of trials needed to gain statistical confidence should be executed across bounding set of 
conditions such as temperature and pre-load. 

- 6-DOF cover separation analysis 

* Activity involves use of a dynamical simulation capable of modeling objects of arbitrary shape, their motion due 
to relative forces, and whether contact occurs. 

* Cases should be run for an exhaustive set of conditions including variations in separation device performance 
and initial altitude and rales of the capsule, 

* Model of separation device used in the simulation will be calibrated by the device characterization test. 

- Full scale first motion separation test 

* Test involves a flight-like forward bay cover and geometrically realistic mock-up of the upper cone area of the 
capsule that arc slowly "walked" away from each other. 

* Will verify that no obvious mechanical interferences exist that could hang- up the separation. 


This briefing is for status only and does not represent complete engineering data analysis 
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1005: Cover near term recontact (2/2) 


* Verification Approach 

- Full scale dynamical aerial separation test 

* Test involves using llight-like hardware and separating the cover from the capsule under flight -l ike conditions 
during an aerial drop test, 

* Will need to execute both nominal and bounding attitude rale cases to confirm validity of separation simulation. 




This briefing is for status onty and does not represent complete engineering data analysis 
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1006: Cover subsequent recontact 


• Element Description 

- Cover flies away from capsule and no subsequent recontact 

* Cover recontact may damage the CM or impair future chute deployment. 

* Verification Approach 

- Cover/vehicle trajectory analysis 

* Activity involves 6-DOF trajectory propagation to determine the relative motion between the cover and capsule. 

* Cases should be run that span an exhaustive range of bounding initial conditions (e.g. velocity, attitude, attitude 
rale) and model dispersions such as aerodynamics and atmospheric conditions. 

- Full scale dynamical aerial separation test 

* Test involves using flight- 1 ike hardware and separating the cover from the capsule under flight -like conditions 
during an aerial drop lest. 

* Will need to execute both nominal and bounding attitude rate cases to confirm validity of separation simulation. 




This briefing is for status onty and does not represent complete engineering data analysis 
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Drogue Mortar Firing 


This briefing is for status only and does not represent complete engineering data analysis 


NESC Request No.: 06-060-E 


0 

NASA Engineering and Safety Center 
Technical Assessment Report 

Document #: 

NESC-RP- 

06-060 

Version: 

1.0 

Title: 

Crew Exploration Vehicle Integrated Landing System 

Page #: 

187 of 314 


2007: Drogue deployment command time 


* Element Description 

- Drogue deployment command sent at proper time 

* Untimely drogue chute deployment may result in chute inflation at improper M/Q/AOA. 

* Verification Approach 

- Integrated avionics test bed and flight software sequence timing test 

* Test requires execution of flight software on (light- like avionics using simulated GNC sensor data to mimic 
response of vehicle to dynamical environment. 

* Will verify that proper liming of issued commands are not subject to hardware to software timing issues. 

* Should be run across a bounding set of eases representing the extremes of dynamics encountered by the vehicle. 




This briefing is for status only and does not represent complete engineering data analysis 
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2008: Gas generator ignition 

* Element Description 

- Gas generator ignites and performs 

* Failure of the gas generator to ignite and perform as expected will result in failed drogue chute extraction. 

* Verification Approach 

- Gas generator characterization and performance test 

* Test involves initiating a statistic ally significant number of flight-like gas generator cartridges in a controlled 
environment to verify reliability of ignition. 

* Should be executed across a hounding range of conditions such as initial temperature, atmospheric density, and 
moisture content 




This briefing is for status only and does not represent complete engineering data analysis 
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2009: Mortar breach pressure at proper level 


* Element Description 

- Mortar breach pressure at proper lev el within allocated time 

* Insufficient mortar breach pressure may result in partial ejection of drogue chute. Failure to breach pressure 
within l lie allocated time may impair the likelihood for success of future parachute events 




* Verification Approach 

- Mortar dosed bomb firing test 

* Test involves tiring a statistically significant number of flight-like mortars in a "bomb chamber" in order to 
verify that the pressure generated in the mortar lube meets expectations. 

• Should be executed across a bounding range of conditions such as initial temperature and atmospheric density. 


This briefing is for status onty and does not represent complete engineering data analysis 
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2010: Drogue chute pack ejection 


* Element Description 

- Chute pack ejected from mortar at proper velocity 

* Insufficient velocity for the ejected drogue chute pack may result in poor line stretch or tangle, and consequently 
may impair subsequent drogue chute inflation. 




* Verification Approach 

- Mortar static fire test with cover 

* Test involves live firings of flight- like mortars with flight-like chute packs on a static test stand. 

- Mo rt a r pe rtb rm a n ce a it a ly s is 

* Activity involves dynamical simulation of the motion of the parachute within the mortar tube as a function of 
overpressure. 

* Model should be mu across lire expected bounding range of pressures, 

- Drogue aerial deployment test 

* Test involves firing flight- 1 ike chute packs from a flight- like mortar during aerial drop tests, 

* Will need to execute cases for both nominal and pad abort scenarios spanning a wide range of conditions 
including initial velocities, attitude and rates, and angles of attack 


This briefing is for status only and does not represent complete engineering data analysis 
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2011: Drogue mortar cover near term recontact 



* Element Description 

- Drogue mortar cover clears capsule without contact 

* The pilot mortar cover contacting in the near term may impair drogue chute extraction. 


* Verification Approach 

- Mortar cover stress analysis 

* Activity involves an analysis of the breaking strength of the mortar cover and cover hold-down attachment 
fittings. 

* Analysis will verify that chute pack has overwhelming momentum to cleanly break cover away from attach 

fittings* 

- Mortar static fire test with cover and upper cone mock up 

* Test involves live firings of night- like chute packs in flight-like mortars attached to a realistic mock-up of the 
forward bay region of the capsule. 

* Will provide confirmation that no obvious problems exist with respect to FOD from the cover separation. 


This briefing is for status only and does not represent complete engineering data analysis 
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2012: Drogue mortar cover subsequent recontact 


* Element Description 

- Drogue mortar cover flies away from capsule and no subsequent recontact 

* Drogue mortar cover recontact may damage the CM or impair drogue chute chute inflation. 

* Verification Approach 

- Cover/vehicle trajectory analysis 

* Activity involves 6-DOF trajectory propagation to determine the relative motion between the mortar cover and 
capsule. 

* Cases should be run that span an exhaustive range of bounding initial conditions (e.g. velocity* altitude, altitude 
rale) and model dispersions such as aerodynamics and atmospheric conditions. 

- Drogue aerial deployment test 

* Test involves firing flight- 1 ike chute packs from a flight- like mortar during aerial drop tests. 

* Will need to execute cases for both nominal and pad abort scenarios spanning a wide range of conditions 
including initial velocities, altitude and rates, and angles of attack 




This briefing is for status onty and does not represent complete engineering data analysis 
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2013: Chute pack line stretch 



* Element Description 

- Chute pack reaches line stretch without hangup, tangle, or interference 

* Hangup, tangle, or interference may result impaired drogue chute operation. 


* Verification Approach 

- Mortar static fire test 

* Test involves live firings of flight- 1 ike mortars with flight-like chute packs on a static test stand. 

- Drogue aerial deployment test 

* Test involves firing flight -I ike chute packs from a flight- like mortar during aerial drop tests. 

* Will need to execute cases for both nominal and pad abort scenarios spanning a wide range of conditions 
including initial velocities, attitude and rates, and angles of attack 


This briefing is for status onty and does not represent complete engineering data analysis 
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2014 : Bag strips off properly 



* Element Description 

- Bag strips off properly 

* Improper removal of the drogue parachute bag may result in partial to zero inflation of drogue chutes. 


* Verification Approach 

- Drogue aerial deployment test 

* Test involves firing flight-like chute packs from a flight- like mortar during aerial drop tests. 

* Will need to execute cases for both nominal and pad abort scenarios spanning a wide range of conditions 
including initial velocities, attitude and rates, and angles of attack 


This briefing is for status only and does not represent complete engineering data analysis 
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2015: Chute pack snatch load 



* Element Description 

- Chute pack survives snatch load 

* The drogue chute pack must survive the snatch load or subsequent drogue chute inflation will not occur. 


* Verification Approach 

- Drogue aerial deployment test 

* Test involves firing flight-like drogue chute packs from a flight-like mortar during aerial drop tests to verify that 
the pack integrity is not compromised by the snatch load. 

* Will need to execute cases for both nominal and pad abort scenarios spanning a wide range of conditions 
including initial velocities, attitude and rates, and angles of attack 

- Drogue deployment loads analysis 

* Analysis involves "multi-body" 6-DOF simulation where forces can be applied to individual components (e.g. 
capsule, risers, chutes) attached to each other and the constrained motion between of each can be observed. 

* Case runs should span an exhaustive range of expected conditions. 

* Will he used to confirm that the expected range of snatch loads docs not exceed rated capacity of parachute 
pack. 


This briefing is for status only and does not represent complete engineering data analysis 
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2016: Mortar reaction loads and dynamics 


* Element Description 

- Capsule and crew tolerant to mortar reaction loads and related dynamics 

* Structural damage and injury to crew may result from higher then expected mortar reaction loads and associated 
dynamics. 




* Verification Approach 

- Drogue ejection shocks and loads transference analysis 

* Activity involves an analysis to determine that the amount of attenuation of the mortar initiation shock, as 
transferred through the structure, results in acceptable level seen at the attach points for critical components and 
the crew, 

- Drogue ejection shocks and loads transference test 

* Test involves measurement of mortar reaction loads and load frequency content on a flight-like structure at 
critical attachment points along the structure. 

* Only need to execute a few representative cases to both confirm the validity of the load transfer analysis, and to 
gather accelerometer data to calibrate die structural attenuation model used in the analysis. 

* Probably executed by placing accelerometers in key structural locations during an aerial in Hal ion test. 


This briefing is for status only and does not represent complete engineering data analysis 
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Drogue Inflation 


This briefing is for status only and does not represent complete engineering data analysis 
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201 7: Drogue inflation conditions 


* Element Description 

- Drogues open and achieves full inflation under expected M/Q/AOA 

* Failure to fill drogues under design conditions may result in loss of drogue chute or inadequate performance. 

* Verification Approach 

- Drogue aerial deployment test 

* Test involves firing flight- 1 ike chute packs from a flight-like mortar during aerial drop tests to verify that chute 
inflation occurs cleanly. 

* Will need to execute cases for both nominal and pad abort scenarios spanning a wide range of conditions 
including initial velocities, attitude and rates, and angles of attack 




This briefing is for status only and does not represent complete engineering data analysis 
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2018: Drogues survive opening loads 


* Element Description 

- Drogues survive opening loads 

* Drogue loss will result in failure to stabilize capsule and may result in pilot chute deployment at undesirable 
conditions* 




* Verification Approach 

- Drogue aerial deploy men! test 

* Test involves firing flight-like chute packs from a flight-like mortar during aerial drop tests to verify that 
opening loads do not cause damage to the chute assembly, 

• Will need to execute cases for both nominal and pad abort scenarios spanning a wide range of conditions 
including initial velocities, altitude and rates, and angles of attack 


This briefing is for status only and does not represent complete engineering data analysis 
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2019: Drogue opening loads and dynamics 


* Element Description 

- Capsule and crew tolerant to drogue opening loads and related dynamics 

* Structural damage and injury to crew may result from higher then expected drogue opening loads and associated 
dynamics. 




* Verification Approach 

- Drogue inflation shocks and loads transference analysis 

* Activity involves an analysis to determine that the amount of attenuation of the drogue inflation shock, as 
transferred through the structure, results in acceptable levels seen at the attach points for critical components and 
the crew, 

- Drogue inflation shocks and loads transference test 

* Test involves measurement of drogue inflation shock loads and load frequency content on a flight- like structure 
at critical attachment points along the structure. 

* Only need to execute a few representative cases to both confirm the validity of the load transfer analysis, and to 
gather accelerometer data to calibrate die structural attenuation model used in the analysis. 

* Probably executed by placing accelerometers in key structural locations during an aerial in Hal ion test. 


This briefing is for status only and does not represent complete engineering data analysis 
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Drogue Operation 
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2020: Drogue drag properties 


* Element Description 

- Drogue drag properties as expected 

* Drogue aerodynamic properties are critieal to stabilizing capsule for subsequent parachute stages. 

* Verification Approach 

- Drogue aerodynamics performance characterization test 

* Test involves aerial drops of drogue chutes to verify aerodynamic properties such as drag and stability as a 
function of angle of attack. 

* Should be executed in both single and dual drogue chute configuration to separate cluster performance artifacts 
from ideal canopy performance. 




This briefing is for status onty and does not represent complete engineering data analysis 
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2021: Drogues interference with one another 



• Element Description 

- Drogues do not interfere with each other 

* Drogues interfering with one another may result in off nominal deceleration and performance. 


• Verification Approach 

- Drogue aerodynamics performance characterization test 

* Test involves aerial drops of drogue chutes in flight-like cluster configuration to verify that aerodynamic 
interaction between the chutes does not interfere with individual chute performance. 

* Should be executed tor a bounding range of conditions such as angle of attack, altitude rates, and winds. 


This briefing is for status onty and does not represent complete engineering data analysis 
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2022: Drogues stabilize capsule 



* Element Description 

- Drogues stabilize capsule 

* Instability following drogue Inflation results in otT nominal attitude for pilot chute deployment. 


* Verification Approach 

- High fidelity' terminal descent multi-body attitude dynamics analysis 

* Analysis involves '"multi-body” 6- DOF simulation where forces can be applied to individual components (e,g. 
capsule, risers, chutes) attached to each other and the constrained motion between each can be observed. 

* Case runs should span an exhaustive range of expected conditions such as initial angle of attack, altitude and 
rales, wind gusts. and single dual drogue configuration. 

* Will he used to dramatically extend the number of cases that otherwise might be impractical to test due to time 
or schedule limitations. 

- Drogue/capsule interaction drop test 

* Test involves utilizing flight-like, mortar-deployed drogue chutes to stabilize altitude rates on a flight-like 
capsule under realistic flight conditions. 

* Cases executed do not have to be exhaustive, but should be bounding with respect to extreme conditions such as 
initial angle of attack, attitude and rates, wind gusts, and single dual drogue configuration. 


This briefing is for status only and does not represent complete engineering data analysis 
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Drogue Release 
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2023: Drogue release at proper time 

* Element Description 

- Drogue release commanded at proper time 

* Untimely drogue release may decrease the chances for subsequent parachute stages success. 

* Verification Approach 

- Integrated avionics test bed and flight software sequence timing test 

* Test requires execution of flight software on (light- Like avionics using simulated GNC sensor data to mimic 
response of vehicle to dynamical environment. 

* Will verify that proper liming of issued commands are not subject to hardware to software timing issues. 

* Should be run across a bounding set of cases representing the extremes of dynamic encountered by the vehicle. 




This briefing is for status only and does not represent complete engineering data analysis 
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2024: Drogue chute line cutters 


* Element Description 

- Drogue line cutters actuate upon command and sever risers 

* Failure to release drogue will hamper main chute deployment. 

* Verification Approach 

- Line cutter performance and characterization test 

* Test involves firing the line cutters in a controlled setting to verify reliability of the device. 

* Should be run across a bounding set of cases including temperature, line pre-load or slack, and line strength, 

- Drogue aerial separation test 

* Test involves using flight- 1 ike line cutlers to sever flight- like drogue lines under a realistic Might environment. 

* Cases should be executed across a bounding set of conditions such as attitude rates and single, dual drogue 
configuration. 

* Will verify that details related to flight conditions and/or conditions that result only when flight hardware is 
utilized do not have adverse affect on performance. 




This briefing is for status only and does not represent complete engineering data analysis 
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Drogue Separation 
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2025: Drogue risers clear capsule 


* Element Description 

- Drogue risers clear capsule without hangup 

* Drogue chute riser hangup may hamper pilot chute deployment . 

* Verification Approach 

- Drogue aerial separation test 

* Test involves using llight-like line cutlers to sever flight-like drogue lines under a realistic Might environment, 

* Cases should he executed across a bounding set of conditions such as attitude rates and single, dual drogue 
configuration. 

* Will verify that details related to flight conditions and/or conditions that result only when flight hardware is 
utilized do not have adverse affect on cutter performance. 




This briefing is for status onty and does not represent complete engineering data analysis 
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2026: Drogue parachute subsequent recontact 


• Element Description 

- Drogue parachute assembly flies away from capsule and no subsequent recontact 

* Drogue parachute recontact may impair pilot chute inflation and main chute extraction . 

• Verification Approach 

- Drogue aerial separation test 

* Test involves separating flight- 1 ike drogue chutes from a flight- like capsule under a realistic environment to 
verify that drogue chute fly-away performance is adequate, 

* Cases should be executed across a bounding set of conditions such as attitude rates and single/dual drogue 
configuration. 




This briefing is for status onty and does not represent complete engineering data analysis 
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Pilot Mortar Firing 
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3027: Pitot chute deployment command 


* Element Description 

- Pilot chute deployment command sent at proper time 

* Untimely pilot chute deployment may result in chute inflation at improper M/Q/AQA. 

* Verification Approach 

- Integrated avionics test bed and flight software sequence timing test 

* Test requires execution of flight software on (light-like avionics using simulated GNC sensor data to mimic 
response of vehicle to dynamical environment. Test will verify that proper timing of issued commands are not 
subject to hardware to software timing issues. 

* Test should span a bounding set of cases representing the extremes of dynamic encountered by the vehicle. 




This briefing is for status onty and does not represent complete engineering data analysis 
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3028: Pilot gas generator ignition 



* Element Description 

- Pilot gas generator ignites and performs 

* Failure of the gas generator to ignite and perform as expected will result in failed pilot chute and subsequent 
main chute extraction. 


* Verification Approach 

- Gas generator characterization and performance test 

♦ Test involves imitating a statistically significant number of flight-like gas generator cartridges in a controlled 
environment to verify reliability of ignition. 

• Test should span across a bounding range of conditions such as initial temperature, atmospheric density, and 
moisture content. 


This briefing is for status onty and does not represent complete engineering data analysis 
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3029: Pilot mortar breach pressure 


* Element Description 

- Pilot mortar breach pressure at proper level within allocated time 

* Insufficient mortar breach pressure may result in partial ejection of the chute pack. Failure to breach pressure 
within l lie allocated time may impair the likelihood for success of future parachute events 




* Verification Approach 

- Pilot mortar closed bomb firing test 

♦ Test involves tiring a statistically significant number of fight-like mortars in a "bomb chamber" in order to 
verify that the pressure generated in the mortar lube meets expectations. 

• Test should span across a bounding range of conditions such as initial temperature and atmospheric density - 


This briefing is for status onty and does not represent complete engineering data analysis 
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3030: Pilot chute pack ejection 


* Element Description 

- Pilot chute pack ejected from mortar at proper velocity 

* Insufficient velocity lor the ejected chute pack may result in poor line stretch or tangle, and consequently may 
impair subsequent pilot chute inflation. 




* Verification Approach 

- Pilot mortar static fire test with cover 

* Test involves live firings of flight- like mortars with flight-like chute packs on a static test stand, 

- Pilot mortar performance analysis 

* Activity involves dynamical simulation of the motion of the parachute within the mortar tube as a function of 
overpressure, 

* Model should run across the expected bounding range of pressures. 

- Pilot aerial deployment test 

* Test involves firing flight- 1 ike chute packs from a flight- like mortar during aerial drop tests, 

* Test needs to cover eases spanning a wide range of conditions including initial velocities, attitude and rates, and 
angles of attack. 


This briefing is for status only and does not represent complete engineering data analysis 
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3031: Pilot mortar cover near term contact 



* Element Description 

- Pilot mortar cover dears capsule without contact 

* The pi lot mortar cover contacting in the near term may impair main chute extraction. 


* Verification Approach 

- Pilot mortar cover stress analysis 

* Activity involves an analysis of the breaking strength of the mortar cover and cover hold-down attachment 
fittings. 

* Analysis w ill verify that chute pack has overwhelming momentum to cleanly break cover away from attach 

fittings* 

- Pilot mortar static fire test with cover and upper cone mock up 

* Test involves live firings of flight- like chute packs in flight-like mortars attached to a realistic mock-up of the 
forward bay region of the capsule. 

* Test will confirm that no obvious problems exist with respect to FOD from the cover separation. 


This briefing is for status only and does not represent complete engineering data analysis 
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3032 : Pilot mortar cover subsequent recontact 


* Element Description 

- Pilot mortar cover flies away with no subsequent recontact 

* The pilot mortar cover recontacting may impair main chute operations or result in structural damage to the CM. 

* Verification Approach 

- Cover/vehicle trajectory analysis 

* Activity involves 6-DOF trajectory propagation to determine the relative motion between the mortar cover and 
capsule. 

* Cases should span an exhaustive range of bounding initial conditions (e.g. velocity, attitude, attitude rate) and 
model dispersions such as aerodynamics and atmospheric conditions. 

- Pilot aerial deployment test 

* Test involves firing (light- 1 ike chute packs from a flight- 1 ike mortar during aerial drop tests. 

* Test must cover wide range of conditions for both nominal and pad abort scenarios, including variations in 
initial velocities, attitude and rates, and angles of attack 




This briefing is for status onty and does not represent complete engineering data analysis 
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3033: Pilot chute pack line stretch 


* Element Description 

- Pilot chute pack reaches line stretch without hangup, tangle, or interference 

* Hangup, tangle, or interference may result impaired chute operation. 

* Verification Approach 

- Pilot mortar static fire test 

* Test involves live firings of flight- like mortars with flight-like chute packs on a sialic test stand. 

- Pilot aerial deployment test 

* Test involves firing flight- 1 ike chute packs from a flight- like mortar during aerial drop tests. 

* Test must include wide range of conditions including initial velocities, attitude and rales, and angles of attack. 




This briefing is for status onty and does not represent complete engineering data analysis 
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3034: Pilot bag strips off properly 



* Element Description 

- Pilot bag strips off properly 

* Improper removal of the parachute hag may result in partial to zero inflation of pilot chutes. 


* Verification Approach 

- Pilot aerial deployment test 

* Test involves firing lliglit-like chute packs from a flight-like mortar during aerial drop tests. 

* Test must include wide range of conditions including initial velocities, attitude and rates, and angles of attack. 


This briefing is for status only and does not represent complete engineering data analysis 


58 


NESC Request No.: 06-060-E 


0 

NASA Engineering and Safety Center 
Technical Assessment Report 

Document #: 

NESC-RP- 

06-060 

Version: 

1.0 

Title: 

Crew Exploration Vehicle Integrated Landing System 

Page #: 

220 of 314 


3035: Pilot chute pack snatch load 


* Element Description 

- Pilot chute pack survives snatch load 

* The pilot chute pack must survive the snatch load or subsequent chute inflation will not occur. 

* Verification Approach 

- Pilot aerial deployment test 

* Test involves firing flight- 1 ike chute packs from a flight-like mortar during aerial drop tests to verify that the 
pack integrity is not compromised by the snatch load. 

* Test must include wide range of conditions including initial velocities, altitude and rales, and angles of attack. 

- Pilot deployment loads analysis 

* Analysis involves ''multi-body" 6-DOF simulation where forces can be applied to individual components (e.g. 
capsule, risers, chutes) attached to each other and the constrained motion between of each can be observed. 

* Case runs should span an exhaustive range of expected conditions. 

* Test will confirm that expected range of snatch loads does not exceed rated capacity of parachute pack. 




This briefing is for status only and does not represent complete engineering data analysis 
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3036 : Pilot chute ejection loads and dynamics 



* Element Description 

- CM and crew tolerant to pilot reaction loads and related dynamics 

* Structural failure and injury to crew may result from higher then expected ejection loads and associated 
dynamics. 


* Verification Approach 

- Pilot ejection shocks and loads transference analysis 

♦ Activity involves an analysis to determine that the amount of attenuation of the mortar initiation shock -- as 
transferred through the structure ~ results in acceptable structural health levels (g-load, stress, strain, etc.) 
experienced by the crew and at the attach points for critical components, 

- Pilot ejection shocks and loads transference test 

* Test involves measurement of mortar reaction loads and load frequency content on a flight-like structure at 
critical attachment points along the structure. 

• Only a few representative cases required to both confirm the validity of the load transfer analysis and to gather 
accelerometer data to calibrate die structural attenuation model used in the analysis. 

* Placement of accelerometers should lay in key structural locations during an aerial i nil alien test. 


This briefing is for status only and does not represent complete engineering data analysis 
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Pilot Inflation 
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3037: Pilot chute inflation conditions 



* Element Description 

- Pilot chute fills with air under expected M/Q/AOA conditions and survives opening loads 

* Failure to fill pilot chute under design conditions may result in pilot chute and subsequent mission loss of 
success. 


* Verification Approach 

- Pilot aerial deployment test 

♦ Test involves firing flight-like chute packs from a flight-like mortar during aerial drop tests to verify that chute 
inflation occurs cleanly. 

• Tests should va ry wide range of conditions including initial velocities, altitude and rates, and angles of attack. 


This briefing is for status only and does not represent complete engineering data analysis 
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3038: Pilot chute survivability 


* Element Description 

- Pilot survives opening loads. 

* Pilot chute failure from opening loads wilt impede main chute extraction. 

* Verification Approach 

- Pilot aerial deployment test. 

* Test involves firing flight-like chute packs from a flight-like mortar during aerial drop tests to verify that 
opening loads do not cause damage to the chute assembly. 

* Tests should vary wide range of conditions including initial velocities, attitude and rales, and angles of attack. 




This briefing is for status only and does not represent complete engineering data analysis 
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3039: Pilot snatch/inflation loads and dynamics 



* Element Description 

- CM and crew tolerant to pilot snatch anil opening loads and related dynamics. 

* Extreme forces from pilot snatch, opening loads, and related dynamics places CM and crew at risk. 


* Verification Approach 

- Pilot inflation shocks and loads transference analysis. 

* Activity involves all analysis to determine that the amount of attenuation of the pilot chute inflation shock — as 
transferred throughout the structure -- results in acceptable structural health levels (g-load, stress, strain, etc.) 
experienced by the crew and at the attach points tor critical components. 

- Pilot inflation shocks and loads transference test. 

* Test involves measurement of pilot inflation shock loads and load frequency content on a flight- 1 ike structure at 
critical attachment points along the structure. 

* Only a few representative cases required to both confirm the validity of the load transfer analysis and to gather 
accelerometer data to calibrate the structural attenuation model used in the analysis. 

* Placement of accelerometers should lay in key structural locations during an aerial inflation test. 


This briefing is for status only and does not represent complete engineering data analysis 
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Main Extraction 
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3040: Main chute extraction 



* Element Description 

- Pilot chutes extract main chutes from forward bay, and line stretch is achieved with no 
interference or entanglement. 

• Entanglement of main chute lines or extraction failure will impede main chute deployment. 


* Verification Approach 

- Pilot/m ain aerial deployment test. 

* Test involves using llight-like, mortar-deployed pilot chutes to extract llight-like main canopies under realistic 
flight conditions during aerial drop tests. 

* Tests should span a wide range of conditions including initial velocities, attitude and rates, and angles of attack, 

* Each case may need to be run several times to reduce the risk that success was a result of fortuitous 
circumstances. 


This briefing is for status only and does not represent complete engineering data analysis 
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3041: Main chute snatch load 


* Element Description 

- Main pack survives snatch load. 

* Excessive snatch load may cause pack to sever from risers. 

* Verification Approach 

- Main aerial deployment test. 

* Test involves using flight- 1 ike, mortar-deployed pilot chutes to extract flight- 1 ike main canopies under realistic 
flight conditions during aerial drop tests. 

* Tests should vary wide range of conditions including initial velocities, attitude and rales, and angles of attack. 

- Main deployment loads analysis. 

* Analysis involves "multi-body" 6-DOF simulation where forces are applied to individual components (e.g. 
capsule, risers, chutes) attached to each other and the constrained motion between of each is observ ed. 

* Case runs should span an exhaustive range of expected conditions. 

* .Analysis will confirm that expected range of snatch loads does not exceed rated capacity of parachute pack. 




This briefing is for status only and does not represent complete engineering data analysis 
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Main Inflation 
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3042: Reefing cutter lanyards and reefing line cutters 



* Element Description 

- Reefing cutter lanyards properly actuate the pyrotechnic delay functions, and cutters sever 
reefing lines 

* Obstruction of reeling line severance will impair main chute inflation. 


* Verification Approach 

- Reefing cutter performance characterization test 

* Test involves firing the line cutters in a controlled setting to verify reliability of the device. 

* Tests should cover bounding set of conditions including temperature: reefing line pre-load or slack: reefing I ine 
strength: and lanyard pull force 

- Main aerial deployment test. 

* Test involves using flight-like, mortar-deployed pilot chutes to extract flight-like main canopies under realistic 
flight conditions during aerial drop tests. 

* Tests should span a wide range of conditions including initial velocities, attitude and rates, and angles of attack, 

* Tests will verify that details related to flight conditions and/or conditions that result only when flight hardware 
is utilized do not have adverse afieci on reefing cutler performance. 


This briefing is for status only and does not represent complete engineering data analysis 
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3043: Main chute inflation conditions. 


* Element Description 

- Main chute inflates properly during each reefing stage under expected M/Q/AOA conditions 
and survives opening loads. 

* Inadequate performance of main chute during deployment, inflation, and operation may endanger CM and crew 
safety. 




• Verification Approach 

- Main aerial deployment test 

* Test involves using flight -like, mortar-deployed pilot chutes to extract flight-like main canopies under realistic 
flight conditions during aerial drop tests. 

* Tests will need to execute cases spanning a wide range of conditions including initial velocities, attitude and 
rales* and angles of attack. 

* Each case may need to be run several times to reduce the risk that success was a result of fortuitous 
circumstances. 


This briefing is for status onty and does not represent complete engineering data analysis 
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3044: Main snatch, opening loads, and dynamics 



* Element Description 

- CM and crew tolerant to main snatch, opening loads, anti related dynamics. 

* Extreme forces from main chute deployment may injure CM and crew. 


* Verification Approach 

- Main inflation shocks and loads transference analysis. 

* Activity involves an analysis to determine lhal the amount of attenuation of the main chute inflation shock •* as 
transferred through the structure -- results in acceptable structural health levels (g-load. stress, strain, etc.) 
experienced by the crew and at the attach points tor critical components. 

- Main inflation release shocks and loads transference test 

* Test involves measurement of main chute inflation shock loads and load frequency content on a flight-like 
structure at critical attachment points along the structure. 

* Tests only need to execute a few representative cases to both confirm the validity of the load transfer analysis 
and to gather accelerometer data to calibrate the structural attenuation model used in the analysis. 

* Placement of accelerometers should lay in key structural locations during an aerial inflation test. 


This briefing is for status only and does not represent complete engineering data analysis 
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Sensor Operation 
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4045: Chute deploy sensor accuracy 


* Element Description 

- EDL sensors generate accurate data when subjected to forces and dynamical transients during 
chute deploy phase. 

* Inaccurate data generation may state estimation accuracy and affect touchdown performance. 

♦ Verification Approach 

- I MU performance characterization test. 

* Test involves subjecting an IMU to m exhaustive set of dynamical conditions in a controlled setting to verity 
whether performance (accuracy, drift, bias, etc.) meets specification. 

* Tests should cover bounding set of accelerations, angular rates, and temperatures. 

- IMU performance characterization analysis. 

* Activity involves use of computer simulation that models the internal mechanisms and software of the IMU to 
predict its output based on a simulated input. 

* Model is calibrated using data gathered from performance characterization test. 

* Although IMU will be tested under flight-like conditions, the simulation is used to dramatically expand the 
number of eases that w ould otherwise be unattainable due to schedule or budget limitations. 

- Parachute to IMU loads transference analysis 

- Parachute deployment shock and loads characterization test 
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State Propagation 
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4046: Chute deploy phase state vector propagation 


* Element Description 

- Attitude position and velocity states propagated or estimated correctly as results of forces and 
dynamical transients during chute deploy phase. 

* Incorrect state vector calculations may obstruct timely deployment of parachute phase. 




• Verification Approach 

- Integrated avionics test bed and flight software sequence test 

* Test requires execution of flight software on flight- 1 ike avionics using simulated GNC sensor data based on 6 - 
DOF trajectory^ simulation to mimic response of vehicle to dynamical environment. 

* Test verifies that no intricate timing issues exist that would cause the GNC software to produce different results 
when running on hardware as opposed to a simulated environment. 

* Tests only need to cover selected, representati ve cases, 

- A Igori th m / software tes t bed. 

* Activity involves isolated unit testing of relevant GNC algorithms using simulated hut realistic input streams 
across all possible ranges of input conditions 

- Parachute descent phase dynamic characterization test. 

* Test involves flying a llight-like parachute, capsule system from forward cover separation to main inflation in 
order to record the dynamical motion experienced by the capsule during the chute deployment process. 

* Test data is used to con Arm dynamical models used in GNC and trajectory simulations. 

* Tests need only cover a few representative cases for nominal descent and pad abort. 


This briefing is for status only and does not represent complete engineering data analysis 
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Chute Deceleration 
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5047: Drag performance of main canopies 


* Element Description 

- Drug performance of main canopies is as expected, including canopy interference issues, 

* Unexpected performance of main canopy drag may break design limits of horizontal rockets and landing airbags 
Which ultimately increases force of ground impact. 




* Verification Approach 

- Main canopy aerodynamics performance characterization test 

♦ Test involves aerial drops of main chutes to verity aerodynamic properties such as drag and stability as a 
function of angle of attack. 

• Tests should involve single, dual, and triple canopy configuration to separate cluster performance artifacts from 
ideal canopy performance. 

* Tests do not explicitly require a flight- 1 ike deployment process, but could piggyback on a deployment test 


This briefing is for status onty and does not represent complete engineering data analysis 
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5048: Stability of main chute cluster 



* Element Description 

- Stability of main chute cluster is as expected. 

* Individual canopies interfering with one another may result in degraded parachute performance. 


* Verification Approach 

- Mailt canopy aerodynamics performance characterization test 

* Test involves aerial drops of main chutes in flight-like cluster configuration to verify that aerodynamic 
interaction between the chutes does not interfere with individual chute performance. 

* Test should cover bounding range of conditions such as angle of attack, attitude rales, and winds 

* Test does not explicitly require a llight-like deployment process but could piggyback on a deployment test 


This briefing is for status only and does not represent complete engineering data analysis 
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5049: Pre-landing attitude states 



* Element Description 

- CM attitude and rates within tolerance when w ithin vicinity of ground, 

* Excessive CM attitude and rales may damage vehicle and harm crew. 


* Verification Approach 

- High fidelity' terminal descent multi-body attitude dynamics analysis, 

* Analysis involves "multi-body" 6- DOF simulation where forces are applied to individual components (e.g. 
capsule, risers, chutes) attached to each other and the constrained motion between of each is observed. 

* Case runs should span an exhaustive range of expected conditions. 

- Parachute/capsule interaction drop test 

* Test involves dropping a flight-like capsule with flight-like main chutes for tbe purpose of observing and 
recording the attitude dynamics of the entire slack. 

* Test need cover only few representative conditions to confirm validity of attitude dynamics analysis. 
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Heatshield Release 
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6050: Heatshield retention device release 


* Element Description 

- Heatshield retention device release commanded at proper time, 

* Untimely command of heatshield retention device release will jeopardize airbag inflation and horizontal retro- 
rocket firing sequence. 




* Verification Approach 

- Integrated avionics test bed and flight software sequence timing test. 

* Test requires execution of flight software on lliglit-like avionics using simulated GNC sensor data to mimic 
response of vehicle to dynamical environment. 

* Test will verify that proper timing of issued commands are not subject to hardware to software timing issues. 

* Should be run across a bounding set of cases representing the extremes of dynamic encountered by the vehicle. 


This briefing is for status onty and does not represent complete engineering data analysis 
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6051: Heatshield retention device release activation 


* Element Description 

- Heatshield retention device releases upon command 

* Failure of heatshield retention device activation to release will cripple airbag deployment and increase landing 
impact forces. 




* Verification Approach 

- Retention device performance and characterization test 

♦ Test involves operating the retention release device in a controlled setting to verify that release occurs in a 
reliable fashion. 

• Sul Helen l number of trials needed for statistical confidence should span across bounding set of conditions such 
as temperature and pre-load. 


This briefing is for status onty and does not represent complete engineering data analysis 
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6052: Heatshield separation device performance 


* Element Description 

- Heatshield separation devices actuate and impart desired velocity, 

* Underperformance of separation device may cause heatshield recontact or ground sensing interference from 
heatshield release. 




* Verification Approach 

— Sep device component performance and characterization test 

* Test involves operating the separation device in a controlled setting to verify that release energy meets 
specification. 

* Sufficient number of trials needed for statistical confidence should span across bounding set of conditions such 
as temperature and pre-load, 

- Heatshield separation analysis. 

* Activity involves use of a dynamical simulation capable of modeling objects of arbitrary shape; respective 
motion due to relative forces; and whether contact occurs, 

* Cases should comprise an exhaustive set of conditions including variations in separation device performance: 
initial attitude; and rales of the capsule. 

* Model of separation device used in the simulation is calibrated by the device characterization test, 

- Full scale lieu (shield separation test. 

* Test involves tiring a flight-like separation device on a full-scale mock-up of the heatshield attached to a mock- 
up of the lower portion of the capsule in a controlled selling, 

* Only eases with representative conditions required to confirm validity of the simulation. 


This briefing is for status onty and does not represent complete engineering data analysis 
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6053 : Heats hield separation forces and dynamics 



* Element Description 

- CM and crew tolerant to release forces and related dynamics. 

* Extreme forces and related dynamics from heatshield release may harm crew and damage CM. 


* Verification Approach 

- Heatshield shocks and loads transference analysis. 

* Analysis is used to determine that the amount of shock attenuation and loads generated from heatshield release - 
- as transferred through the structure -- results in acceptable structural stress/strain/ loads/etc. level experienced 
by the crew and at the attach points of critical components. 

- Heatshield shocks and loads transference test 

* Test involves measurement of the heatshield release shock and loads on a flight-like structure at critical 
attachment points along the structure. 

* Only a few representative cases required to both confirm the validity of the shock transfer analysis and to gather 
accelerometer data to calibrate the structural attenuation model used in the analysis, 


This briefing is for status only and does not represent complete engineering data analysis 
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Heatshield Separation 
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6054: Heatshield near term recontact (1 of 2) 


* Element Description 

- Hen [shield clears capsule without contact 

* Recontact of heatshield with capsule will damage CM; may cause harm to crew; will alter entry trajectory; and 
may cause unacceptable attitude dynamics. 




* Verification Approach 

- Sep device component performance and characterization test 

* Test involves operating the separation device in a controlled setting to verify that release energy meets 
specification, 

* A sufficient number of trials necessary for statistical confidence should cover bounding set of conditions such as 
temperature and pre-load. 

- 6-DOF heatshield separation analysis. 

* Activity involves use of a dynamical simulation capable of modeling objects of arbitrary shape; respective 
motion due to relative forces; and whether contact occurs, 

* Cases should cover exhaustive set of conditions in eluding variations in separation device performance, initial 
attitude, and rates of the capsule, 

* Model of separation device used in the simulation will be calibrated by the device characterisation lest. 

- Configuration obstructions analysis. 

* Test involves a night-like heatshield and geometrically realistic mock-up of the lower region of the capsule that 
are slowly "walked" away from each oilier. 

* Test will verify that no obvious mechanical interferences exist that could hang-up the separation. 
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6054: Heatshield near term recontact ( 2 of 2) 


* Verification Approach (cont*) 

- Full Scale first motion separation test 

* Test involves using flight- 1 ike hardware and separating the cover from the capsule under flight-like conditions 
during an aerial drop test, 

* Test runs should include both nominal and bounding attitude rate cases to confirm validity of separation 
simulation. 
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6055: Heatshield long term separation 


* Element Description 

- Heatshield flies away from capsule with no subsequent recontact, and moves far enough away 
w ithin the allocated time to preclude ground sensing interference. 

• Ground sensing interference from released heatshield may obstruct EDL sensors critical to airbag inflation and 
horizontal rocket Hirings, 




• Verification Approach 

- Heutshield/veliR'Ic trajectory' analysis. 

* Activity involves 6-DOF trajectory propagation to determine the relative motion between the heatshield and 
capsule. 

* Cases run should incorporate exhaustive range of bounding initial conditions (e.g. velocity, attitude, attitude 
rale), and model dispersions such as aerodynamics and atmospheric conditions. 

- Full scale heatshield separation test. 

* Test involves using flight-like hardware and separating the heatshield from the capsule under flight-like 
conditions during an aerial drop test. 

* Test executions will include both nominal and bounding attitude rate eases to confirm validity of separation 
simulation. 
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7056: Altitude and velocity sensor activation 


* Element Description 

- Attitude and velocity sensors commanded to activate at the proper time. 

* Delayed activation of altitude and velocity sensors may result in degraded in GNC performance during terminal 
descent, possibly leading to degraded airbag and retro-rocket performance. 




* Verification Approach 

- Integrated avionics test hed anti flight software sequence timing test 

* Test requires execution of flight software on flight- like avionics using simulated GNC sensor data to mimic 
response of vehicle to dynamical environment, 

* Test w ill verify that proper timing of issued commands are not subject to hardware to software Liming issues. 

* Test should encompass bounding set of cases representing the extremes of dynamic encountered by the vehicle. 


This briefing is for status only and does not represent complete engineering data analysis 


89 


NESC Request No.: 06-060-E 


0 

NASA Engineering and Safety Center 
Technical Assessment Report 

Document #: 

NESC-RP- 

06-060 

Version: 

1.0 

Title: 

Crew Exploration Vehicle Integrated Landing System 

Page #: 

251 of 314 



Sensor Acquisition 
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7057: Altitude and velocity sensor lock-up 



* Element Description 

- Attitude and velocity sensors achieve unambiguous lock on the ground within allocated time, 

* Fluctuating sensor lock on ground by wilt adversely affect GN C calculations 
(airbag inflation, horizontal rocket firings, filial CM attitude). 


* Verification Approach 

- Radar characterization field test. 

* Test requires Hying a flight- like sensor from above to below its expected ground acquisition altitude under 
bounding conditions of drop velocity, altitude rales, and encountered terrain types, 

- Radar performance characterization laboratory test 

* Test requires use of ground support equipment that lakes sensor output and applies proper signal delay and 
distortion prior to feeding signal back to the sensor 

* Ground support equipment is used to simulate the sensor in the laboratory and allow for an understanding of 
performance under ideal conditions. 


This briefing is for status only and does not represent complete engineering data analysis 
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Sensor Operation 
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7058: Performance of altitude and velocity sensors 


* Element Description 

- Altitude and velocity sensors generate data that meets accuracy requirements in the presence of 
terrain effects and capsule dynamics. 

* Inability of alt/vel sensors to operate in all-terrain environment will hinder CM landing site options. 

* Verification Approach 

- Radar characterization field test. 

* Test requires Hying a flight- like sensor over all expected terrain types within the selected landing sites to 
confirm dial actual performance meets requirements* 

* Test will involve dropping the sensor across entire range of plausible descent velocities over all expected terrain 
types. 

- Ra da r pc rfo rm a n ce c It a ra c t e ri/ a t io n la bo ra to ry tc s t 

* Test requires use of ground support equipment that takes sensor output and applies proper signal delay & 
distortion prior to feeding signal back to the sensor. 

* Ground support equipment is used to simulate the sensor in the laboratory 7 and allow for an understanding of 
performance under ideal conditions. 

- Modeled radar performance simulation. 

* Activity involves use of computer simulation that models the output of the sensor; interaction of the sensor's 
signal with the ground: and internal processing oflhe signal upon receipt. 

* Simulation is anchored by performance data collected in the field and laboratory'. 

* Simulation is critical to dramatically extend (experimental) lest ease scenarios which are otherwise unattainable 
due to schedule limitations. 
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Roll Orientation Selection 
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7059 : Landing attitude selection 


* Element Description 

- GNC computes direction of horizontal motion and selects appropriate landing attitude. 

* Errors in GNC computation of horizontal motion and resulting landing attitude may result in degraded airbag 
and horizontal velocity abatement performance. 




* Verification Approach 

— Algorithm / software test bed 

* Activity involves isolated Unit testing of relevant GNC algorithms using simulated, but realistic input streams 
across all possible ranges of input conditions 

- Comprehensive EDL trajectory' and dynamics simulations 

* Activity involves use of 6- DOF trajectory propagation with embedded virtual, but calibrated sensor models and 
embedded flight software code in a closed loop simulation, 

* Trajectory eases should exhaustively encompass expected bounding dynamical conditions, and output behavior 
of GNC' algorithms should be inspected for correct behavior. 

- Integrated avionics test bed and flight software sequence timing test. 

* Test requires execution of flight software on flight-like avionics using simulated GNC sensor data based on 6- 
DOF trajectory simulation to mimic response of vehicle to dynamical environment, 

* Test will verify that no intricate Liming issues exist that would cause the GNC software to produce different 
results when running on hardware as opposed to a simulated environment. 

* Only selected, representative cases necessary' for complete test. 


This briefing is for status only and does not represent complete engineering data analysis 
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Thruster Firings 
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7060: Timely command of RCS thrusters 


* Element Description 

- RCS thruster firing command sent at proper time* 

* Mistimed thruster firing commands equates to poor vehicle roll control. 

* Verification Approach 

- Integrated avionics test bed and flight software sequence timing test. 

* Test involves firing flight-like thrusters in a controlled setting to determine whether performance characteristics 
meet expectations. 

* A sufficient number of trials necessary for statistical confidence should span across bounding set of conditions 
such as temperature, feed pressure, and pulse duration. 

* Data collected is also used to create accurate thruster models for use in trajectory simulations. 




This briefing is for status onty and does not represent complete engineering data analysis 
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7061: RCS Thruster performance 


* Element Description 

- RCS thruster ISP and thrust properties are as expected. 

* Poor thruster performance may result in overAinder-peiformanoe of torque control. 

* Verification Approach 

- ACS thruster characterization and performance test stand firings 

* Test involves firing flight-like thrusters in a controlled setting to determine whether performance characteristics 
meet expectations. 

* A sufficient number of trials necessary for statistical confidence should span across bounding set of conditions 
such as temperature, feed pressure, and pulse duration. 

* Data collected is also used to create accurate thruster models for use in trajectory simulations. 




This briefing is for status onty and does not represent complete engineering data analysis 
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7062: Adverse RCS plume impingement 



* Element Description 

- No adverse plume impingement effects from RCS thrusters on CM 

* Adverse plume impingement may cause CM bum-through or parachute riser failure (Apollo 1 5), 


• Verification Approach 

- Capsule plume impingement and vehicle configuration analysis 

* Activity involves 3-dimeiisioiial modeling lo determine if expected plume will impinge oil capsule or 
parachutes. Will need to model temperature and velocity of exhaust as a function of distance from the nozzle 
and compare with sensitivity of vehicle to plume intensity. 

- ACS thruster characterization and performance test stand firings 

* Test involves firing flight-like thrusters in a controlled setting to verify shape and size of thruster plume for use 
in plume impingement analysis, 

* A sufficient number of trials necessary for statistical confidence should span across bounding set of conditions 
such as temperature, feed pressure, and pulse duration, 

- Thruster/ capsule interaction test 

* Test involves firing flight- like thrusters attached to a capsule mock-up with flight -I ike fidelity in exterior 
geometry, including parachute risers. 

* Only a few representative cases necessary to confirm the validity of the plume impingement analysis, 

* Data collected should also examine that deposited particulates from the exhaust do not pose a hazard to seals, 
windows, and vents. 


This briefing is for status only and does not represent complete engineering data analysis 
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7063: Roll torque performance under chute 


* Element Description 

- Resultant torque on vehicle is as expected, including effects from chute risers* 

* Unexpected resultant torque may affect desired final landing attitude conditions. 

* Verification Approach 

- High fidelity' terminal descent attitude dynamics analysis 

* Analysis involves "multi-body" 6- DOF simulation where forces can be applied to indi vidua! components (e.g. 
capsule* risers, chutes) attached to each other and the constrained motion between of eaeh can be observed. 

* Case runs should span an exhaustive range of expected conditions. 

- Th rus ter/capsule/ rise r interacts n test 

* Test involves hanging a capsule from parachute risers and tiring thrusters to rotate the capsule under the risers. 

* Only a few representative cases necessary' to verify fidelity of altitude dynamics analysis. 

* Data collected should include performance of the risers (e,g, torsional stiffness, elasticity') to calibrate input 
parameters in the attitude dynamics analysis. 
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7064: Final landing attitude targeting by GNC 



* Element Description 

- GNC control logic performs correctly in targeting and achieving final attitude conditions. 

* Errors in GNC control logic will result in missing desired final attitude conditions. 


* Verification Approach 

- Algorithm/sofhvare test bed 

* Activity involves isolated unit testing of relevant GNC algorithms using simulated, but realistic input streams 
across all possible ranges of input conditions 

- High fidelity terminal descent attitude dynamics analysis 

* Activity involves use of "multi-body" trajectory and attitude propagation with embedded virtual but calibrated 
sensor models and embedded flight software code in a closed Loop simulation. 

* Cases should exhaustively span expected bounding dynamical conditions, and output behavior of GNC 
algorithms should be inspected for correct behavior. 

- Integrated avionics test bed and flight software sequence timing test. 

* Test requires execution ol'llight software on flight-like avionics using simulated GNC sensor data based on 6- 
DOF trajectory simulation to mimic response of vehicle to dynamical environment 

* Test will verify that no intricate timing issues exist that would cause the GNC software to produce different 
results when running on hardware as opposed to a simulated environment. 

* Test need only cover selected representative eases. 


This briefing is for status only and does not represent complete engineering data analysis 
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Trigger Computation 


This briefing is for status only and does not represent complete engineering data analysis 


NESC Request No.: 06-060-E 


0 

NASA Engineering and Safety Center 
Technical Assessment Report 

Document #: 

NESC-RP- 

06-060 

Version: 

1.0 

Title: 

Crew Exploration Vehicle Integrated Landing System 

Page #: 

264 of 314 



7065: Airbag inflation time 



* Element Description 

- GNC computes correct altitude anil time to inflate airbags. 

* Mistimed airbag inflation could degrade airbag performance. 


* Verification Approach 

- Algorithm f software test bed 

* Activity involves isolated unit testing of relevant GNC algorithms using simulated, but realistic input streams 
across all possible ranges of input conditions 

- Comprehensive EDL trajectory anil dynamics simulations 

* Activity involves use of multi -DOF trajectory propagation with embedded virtual but calibrated sensor models 
and embedded flight software code in a elosed loop simulation. 

* Trajectory cases should exhaustively span expected hounding dynamical conditions, and output behavior of 
GNC algorithms should be inspected for correct behavior. 

- Integrated avionics test bed and flight software sequence timing test. 

* Test requires execution ofllight software on flight- like avionics using simulated GNC sensor data based on 6- 
DOF trajectory simulation to mimic response of vehicle to dynamical environment. Will verify that no intricate 
timing issues exist that would cause the GNC software to produce different results when running on hardware as 
opposed to a simulated environment. 

* Test need only cover selected, representative cases. 


This briefing is for status only and does not represent complete engineering data analysis 
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7066 : Horizontal rocket firing time 


* Element Description 

- GNC computes correct altitude and time to fire horizontal rockets, 

* False predictions of horizontal rocket firings may cause intolerable torques and. or misalign acceptable landing 
attitude and location. 




* Verification Approach 

— Algorithm / software test bed 

* Activity involves isolated Unit testing of relevant GNC algorithms using simulated, but realistic input streams 
across all possible ranges of input conditions 

“ Comprehensive EDL trajectory and dynamics simulations 

* Activity involves use of 6-DOF trajectory propagation with embedded virtual, but calibrated sensor models and 
embedded (light software code in a closed loop simulation, 

* Trajectory cases should exhaustively span expected bounding dynamical conditions, and output behavior of 
GNC algorithms should be inspected for correct behavior 

- Integrated avionics test bed and flight software sequence timing test. 

* Test requires execution of flight software on flight-like avionics using simulated GNG sensor data based on 6- 
DOF trajectory simulation to mimic response of vehicle to dynamical environment. 

* Test will verify that no intricate Liming issues exist that would cause the GNC software to produce different 
results when running on hardware as opposed to a simulated environment. 

* Test need only cover selected, representative cases. 


This briefing is for status only and does not represent complete engineering data analysis 
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Airbag Inflation 
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706 7: Timely command activation of retention device 



* Element Description 

- Retention release command sent at proper time* 

* Belay in release of' airbag retention device may barm CM and crew upon landing. 


* Verification Approach 

- Integrated avionics test bed and flight software sequence timing test. 

* Test requires execution of flight software on flight- like avionics using simulated GNC sensor data based on 6 - 
DOF trajectory simulation to mimic response of vehicle to dynamical environment. 

* Test will verify that no intricate timing issues exist that would cause the GNC software to produce different 
results when running on hardware as opposed to a simulated environment. 

* Test need only cover selected, representative cases. 


This briefing is for status onty and does not represent complete engineering data analysis 
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7068: Airbag retention device release 

* Element Description 

- Airbag retention device released upon command. 

* Failure in airbag retention device to not release may hinder airbag inflation. 

* Verification Approach 

- Retention device performance and characterization test 

* Test involves operating the retention release device in a controlled setting to determine if performance meets 
expectations. 

* A sufficient number of trials necessary' for statistical confidence should span bounding set of conditions such as 
temperature, pre-load, and retention stiffness. 




This briefing is for status only and does not represent complete engineering data analysis 
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7069: Airbag gas generator ignition 



* Element Description 

- Airbag gas generator ignition or activation command sent at proper time* 

* Untimely activation of gas generator may degrade airbag performance. 


* Verification Approach 

- Integrated avionics test bed and flight software sequence timing test. 

* Test requires execution of flight software on flight- like avionics using simulated GNC sensor data based on 6 - 
DOF trajectory simulation to mimic response of vehicle to dynamical environment 

* Test will verify that no intricate timing issues exist that would cause the GNC software to produce different 
results when running on hardware as opposed to a simulated environment. 

* Test need only cover selected, representative cases. 


This briefing is for status only and does not represent complete engineering data analysis 
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7070: Airbag inflation device command 


* Element Description 

- Airbag inflation device ignites or activates upon command 

* Failure of airbag inflation upon command threatens success of CM and crew landing. 

* Verification Approach 

- Inflation device performance and characterization test 

* Test involves operating llie inflation device in a controlled setting to determine if the pressure and flow rate 
output meets expectations. 

* A sufficient number of trials necessary for statistical confidence should span bounding set of conditions such as 
temperature and ambient pressure. 
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7071: Achieving airbag pressure level 



* Element Description 

- All airbags fill to desired level of pressure within allocated time* 

* Untimely attainment of acceptable airbag pressure level may degrade airbag performance. 


* Verification Approach 

- Airbag inflation test 

* Test involves repeated inflations of flight-like airbags using flight- like inflation devices under nominal and 
bounding cases of initial temperature. 

* A structural mock-up with an accurate representation of the capsule bottom should be used to verify that no 
hang- ups occur during die in 11 at ion process 


This briefing is for status only and does not represent complete engineering data analysis 
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7072: Maintaining airbag pressure level 


• Element Description 

- Airbags maintain proper pressure level until ground impact is achieved 

* Loss of acceptable airbag pressure levels may degrade airbag performance. 

* Verification Approach 

- Airbag inflation anti leak test 

* Test involves inflating the airbags in a controlled setting under nominal and hounding eases of initial 
temperature to verify that the inflation device can maintain proper operating pressure for the requisite duration 
of time. 

* Test should also include data collection on airbag leak rate. 
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7073: Airbag inflation loads and dynamics 


* Element Description 

- CM and crew tolerant to loads and dynamics associated with airbag inflation, 

* Structural damage and injury to crew may result from higher then expected airbag inflation loads and associated 
dynamics. 




* Verification Approach 

- Airbag shocks and loads transference analysis 

* Activity involves an analysis to determine that the amount of attenuation of airbag inflation shock and loads, as 
transferred through the structure, results in acceptable level seen at the attach points for critical components and 
the crew, 

- Airbag shocks and loads transference test 

* Test involves measurement of airbag inflation shock and loads on a flight-like structure at critical attachment 
points along the structure. 

* Only need to execute a few representative cases to both confirm the validity of the shock transfer analysis, and 
to gather accelerometer data to calibrate the structural attenuation model used in the analysis. 


This briefing is for status only and does not represent complete engineering data analysis 
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Sensor Operation 
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8074: EDL sensors during chute descent phase 


* Element Description 

- EDL sensors generate accurate data when subjected to forces and dynamical transients during 
chute descent phase 

• Subjected to forces and dynamic transients, EDL sensors must perform as expected for timely command of 
horizontal velocity reduction. 




• Verification Approach 

- IIVIU performance characterization test 

* Test involves subjecting an 1MU to an exhaustive set of dynamical conditions in a controlled setting to verify 
whether performance (accuracy, drift, bias, etc.) meets specification. 

* Should be executed across bounding set of accelerations, angular rates, and temperatures. 

- IMU performance characterization analysis 

- Radar performance characterization field test 

* Activity involves use of computer simulation that models the internal mechanisms and software of the IMU to 
predict its output based on a simulated input, 

* Model will be calibrated using data gathered from performance characterization test. 

* Although IMU will be tested under flight-like conditions, simulation will be used to dramatically expand the 
number of cases that might otherwise be Impractical to test due to schedule or budget limitations. 

- Radar performance characterization analysis 


This briefing is for status only and does not represent complete engineering data analysis 
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State Propagation 
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8075: Chute descent phase state propagation 1/2 


* Element Description 

- Attitude and pos/vel states propagated or estimated correctly when subjected forces and 
dynamical transients during chute descent phase 

* Failure to correctly interpret and propagate sensor data will result in improper command of horizontal rocket 
velocity reduction. 




• Verification Approach 

- Integrate avionics test bed and flight software sequence test 

* Test requires execution of flight software on llight-like avionics using simulated GNC sensor data based on 6- 
DOF trajectory simulation to mimic response of vehicle to dynamical environment. 

* Will verify that no intricate timing issues exist that would cause the GNC software to produce different results 
when running on hardware as opposed to a simulated environment. 

* Only need to be run for selected, representative cases, 

- A Igo r i th m /so ft w a re tes t be d 

* Activity involves isolated unit testing of relevant GNC algorithms using simulated, hut realistic input streams 
across all possible ranges of input conditions 

- Parachute descent phase dynamics characterization test 

* Test involves flying the parachute capsule system from deployment to low altitudes in order to record the 
dynamical motion experienced by the capsule while "swinging" under the chutes. 

* Data will be used to confirm dynamical models used in GNC and trajectory simulations. 

* Should be executed for a few representative cases for nominal descent and pad abort. 


This briefing is for status only and does not represent complete engineering data analysis 
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8075: Chute descent phase state propagation 2/2 



* Verification Approach (cont*) 

- Parachute descent phase dynamics characterization test 

* Test involves flying the parachute capsule system from deployment to low altitudes in order to record the 
dynamical motion experienced by the capsule while "swinging" under the chutes. 

* Data will be used to confirm dynamical models used in GNC and trajectory simulations, 

* Should he executed for a few representative cases for nominal descent and pad abort. 


This briefing is for status only and does not represent complete engineering data analysis 
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Horizontal Velocity Reduction 
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9076: Horizontal rockets ignition time 


* Element Description 

- Horizontal rockets commanded to ignite at the proper time 

* Untimely ignition of horizontal rockets will cause unexpected attitude, rates, and velocity of capsule. 

* Verification Approach 

- Integrated avionics test bed and flight software sequence timing test 

* Test requires execution of flight software on (light- like avionics using simulated GNC sensor data based on 6 - 
DOF trajectory simulation to mimic response of vehicle to dynamical environment. 

* Will verify that no intricate timing issues exist that would cause the GNC software to produce different results 
when running on hardware as opposed to a simulated environment. 

* Only need to be run for selected, representative cases. 




This briefing is for status only and does not represent complete engineering data analysis 
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9077: Horizontal rockets ignite 



* Element Description 

- Horizontal rockets ignite upon command 

* Failure of horizontal rocket ignition will hinder airbag performance which may cause dynamically unstable 
landing conditions. 


* Verification Approach 

- Horizontal rocket characterization and performance test stand firings 

* Test involves firing flight-like roekets in a controlled setting to verify reliability of ignition. 

* Will also generate data on thrust onset rise times to be used in rocket models within trajectory and dynamics 
simulations. 


This briefing is for status only and does not represent complete engineering data analysis 
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9078: Horizontal rocket thrust and ISP 


* Element Description 

- Horizontal rocket thrust and ISP profile are as expected* 

* Unexpected thrust and ISP performance will result in undesirable altitude, rates, and velocity profiles. 

* Verification Approach 

- Horizontal rocket characterization and performance test stand firings 

* Test involves firing flight- 1 ike rockets in a controlled selling to determine whether performance characteristics 
meet expectations. 

* A sufficient number of trials needed to gain statistical confidence should be executed across bounding set of 
conditions such as grain temperature. 

* Data will also be used to create accurate thruster models for use in trajectory simulations. 




This briefing is for status only and does not represent complete engineering data analysis 
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9079: Horizontal rockets decelerate capsule 


* Element Description 

- Horizontal rockets decelerate capsule to velocity limits prior to impact 

* Failure of horizontal rockets to perform as expected will cause unacceptable horizontal velocities and possible 
capsule roll over- 




* Verification Approach 

- Parachute/capsule horizontal rocket interaction firing test 

* Test involves tiring llight-Jike horizontal rockets during a drop test with flight -like parachutes, and a capsule 
with the correct mass properties. 

* Will confirm validity of capsule response dynamical analysis and that second-order effects due to parachute 
interaction with the capsule are adequately modeled. 

* Only needs to be run for a few representative cases. 

- Capsule response dynamics analysis 

* Analysis involves "multi-body" 6- DOF simulation where forces can be applied to individual components (e.g. 
capsule, risers, chutes) attached to each other and the constrained motion between of each can be observed. 

* Case runs should span an exhaustive range of expected conditions. 


This briefing is for status only and does not represent complete engineering data analysis 
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9080: Post-burn attitude and rates 


* Element Description 

- Post-burn attitude and rates within tolerance 

* Expected post-bum attitude and rates assessment is essential to preventing unfavorable CM landing attitudes. 

* Verification Approach 

- Paracli utc/eapsule ho rizon ta l rocket in tera ction fi ring test 

* Test involves firing flight-like horizontal rockets during a drop test with Flight-like parachutes* and a capsule 
with the correct mass properties. 

* Will confirm validity of capsule response dynamical analysis and that second-order effects due to parachute 
interaction with the capsule are adequately modeled. 

* Only needs to be run for a few representative cases. 

- Capsule response dynamics analysis 

* Analysis involves “multi-body" 6- DOE simulation where forces can be applied to individual components (e.g. 
capsule, risers, chutes) attached to each other and the constrained motion between of each can be observed. 

* Case runs should span an exhaustive range of expected conditions. 




This briefing is for status only and does not represent complete engineering data analysis 
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9081: Rocket burn loads and dynamics 


* Element Description 

- CM and crew tolerant to loads and dynamics associated with rocket burn 

* Structural failure and injury to crew may result from inaccurate prediction of rocket bum loads and dynamics. 




* Verification Approach 

- Horizontal rocket firing shocks and loads transference analysis 

* Test involves measurement of rocket loads and load frequency content on a flight- like structure at critical 
attachment points along the structure. 

* Only need to execute a few representative cases to both confirm the validity of the load transfer analysis, and to 
gather accelerometer data to calibrate the structural attenuation model used in the analysis, 

* Measurements should also be gathered to verify that acoustical effects are acceptable. 

- Horizontal rocket/capsule interaction test firing 

* Activity involves an analysis to determine that the amount of attenuation of the rocket firing shoeL as 
transferred through the structure, results in acceptable levels seen at the attach points for critical components and 
the crew. 


This briefing is for status only and does not represent complete engineering data analysis 


124 


NESC Request No.: 06-060-E 


0 

NASA Engineering and Safety Center 
Technical Assessment Report 

Document #: 

NESC-RP- 

06-060 

Version: 

1.0 

Title: 

Crew Exploration Vehicle Integrated Landing System 

Page #: 

286 of 314 



9082: Plume impingement on CM 



* Element Description 

- No adverse plume impingement effects on CM 

* An adverse plume impingement may compromise backshell integrity via plume bum through. 


• Verification Approach 

- Capsule plume impingement and vehicle configuration analysis 

* Activity involves 3-dimensional modeling to determine if expected plume will impinge on capsule. 

* Will need to model temperature and velocity of exhaust as a function of distance from the nozzle and compare 
with sensitivity of vehicle to plume intensity. 

- Horizontal rocket characterization and performance test stand firings 

* Test involves firing flight- 1 ike rockets in a controlled setting to verify shape and size of thruster plume for use in 
plume impingement analysis, 

* A Sufficient number of trials needed to gain statistical confidence should be executed across bounding set of 
conditions such as grain temperature and ground effects. 

- Horizontal rocket/capsule interaction test firing 

* Test involves firing flight-like rockets attached to a capsule mock-up with flight-like fidelity in exterior 
geometry'. 

* A few representative eases should be Tim to confirm the validity of the plume impingement analysis, 

* Data should also be collected to verify that deposited particulates from the exhaust do not pose a hazard to seals, 
windows, and vents. 


This briefing is for status only and does not represent complete engineering data analysis 
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Airbag Operation 
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1183: Airbag stroke performance 


* Element Description 

- Airbag stroke capability and performance as expected 

* Airbag stroke capability outside the design specifications may lead to unacceptable impact loads and unstable 
mode conditions. 




• Verification Approach 

- Airbag characterization bounding test 

* Laboratory lest under controlled conditions to verify stroke performance as a function of velocity on a single 
bag. 

* Data will also be used to anchor airbag pressure and stroke analysis. 

- Airbag pressure and stroke analysis 

* Computer simulation of airbag stroke across entire range of expected initial velocity conditions and expected 
pressure dispersions 


This briefing is for status onty and does not represent complete engineering data analysis 
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1184: Airbags vented at proper time 1/2 


* Element Description 

- A irbugs vented at the proper ti me 

* Venting of inflated airbags upon impact (proper time) prevents unstable inode and reduces associated impact 
energy. 




* Verification Approach 

- Integrated avionics test bed and flight software sequence tinning test 

* Test requires execution of flight software on lliglu-like avionics using simulated GNC sensor data based on 6- 
DOF trajectory simulation to mimic response of vehicle to dynamical environment 

* Will verify that no intricate timing issues exist that would cause the GNC software to produce different results 
when Tunning on hardware as opposed to a simulated environment. 

* Only need to be run for selected, representative cases, 

- Sensor characterization and qualification test 

* Test involves characterization of pressure sensors in a control led envi roninent to verify that pe rib mi anee meets 
accuracy specifications, 

* Must characterize performance over entire range of expected temperatures and pressures. 

— Controlled laboratory venting test 

* Test involves using a flight-like pressure sensor to trigger venting of a flight-like airbag in a controlled setting 
under an exhaustive set of conditions. 

* Will be used to verify that the precision and repeatability to which venting can be performed is acceptable. 


This briefing is for status only and does not represent complete engineering data analysis 
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1184: Airbags vented at proper time 2/2 


* Verification Approach (cont*) 

- Airbag performance characterization drop test 

* Test involves dropping a flight-like airbag attached to either a flight-like capsule or equivalent mass simulator 
under an enveloping set of initial velocity, orientation, and terrain effect conditions. 

* Each test should be analyzed to confirm venting performance. 




This briefing is for status only and does not represent complete engineering data analysis 


129 


NESC Request No.: 06-060-E 


0 

NASA Engineering and Safety Center 
Technical Assessment Report 

Document #: 

NESC-RP- 

06-060 

Version: 

1.0 

Title: 

Crew Exploration Vehicle Integrated Landing System 

Page #: 

291 of 314 


1185: Airbag integrity 


* Element Description 

- Airbags integrity not compromised by interaction with terrain 

* Failure to account for interaction with terrain may compromise airbag integrity. 

* Verification Approach 

- Airbag terrain interaction drop test 

* Test involves dropping a flight* like airbag attached to either a flight-like capsule or equivalent mass simulator 
under enveloping conditions of velocity, orientation, and terrain features (rocks, plants, etc.) 

- Airbag materials qualification test 

* Test involves measuring the abrasion and puncture resistance characteristics of airbag material coupons when 
exposed to simulated stresses and strains. 

* Will verify that the strength of the material used in the airbags meets specification. 

- Landing site investigation 

* Data collection of major landing sites and subsequent terrain map generation. 




This briefing is for status onty and does not represent complete engineering data analysis 
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Impact Attenuation 


This briefing is for status only and does not represent complete engineering data analysis 
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1 186: Crew seat performance 



* Element Description 

- Crew seat restraint and stroke capability and performance as expected 

* Severe crew injury may result from inadequate performance of crew seat restraint and stroke capability. 


* Verification Approach 

- Crew seat and loads impact analysis 

* Activity involves Unite element analysis to determine whether the seal impact attenuation 

- Crew seat laboratory loads test 

- High fidelity capsule impact test 

* Representative of actual capsule impact conditions 

* Instrumented helicopter or drop lower tests 


This briefing is for status only and does not represent complete engineering data analysis 
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1187: Crew impact loads 


* Element Description 

- Load transmitted to crew due to impact is as expected 

* Excessive loads on crew during impact may result in severe injury. 

* Verification Approach 

- Landing impact load transmission analysis 

* Finite element dynamics analysis performed across bounding range or impact velocities and orientations, with 
loads transmitted through inflated airbags 

- High fidelity capsule impact test 

* Will require flight like capsule with realistic load paths including tanks, airframe, airbags, crew couch, and 
instrumented human crash test articles 

* Drop scenarios should include a representative range in impact velocities and orientations 

* Needs to include water landing scenarios with or without airbags as appropriate 

* Goal is to provide model and parameter correlation data for the impact loads and dynamics analysis as well as a 
physical demonstration that simulation results are accurate 




This briefing is for status onty and does not represent complete engineering data analysis 
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1188: Post-impact attitude and rates 



* Element Description 

- Post-impact attitude and rates are as expected 

* Excessive attitudes and rates after impact may result lit capsule roll over. 


* Verification Approach 

- Impact dynamics analysis 

* 6 DOF dynamics analysis performed across hounding range of airbag impact velocities and orientations 

- High fidelity' landing dynamics test 

* Requires flight configuration airbags, but simulated capsule mass with flight mass properties is sufficient 

* Drop scenarios should include a representative range in impact velocities and orientations 

* Goal is to provide model and parameter correlation data for the impact dynamics analysis 


This briefing is for status only and does not represent complete engineering data analysis 
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1189: Impact structural integrity 



* Element Description 

- Capsule maintains appropriate structural integrity and un consumed volatiles not released 

* Failure of structural integrity can result in structural deformation and crew injury. 

* Breach in main pressure vessel may cause capsule to sink. 


• Verification Approach 

- Impact loads and dynamics analysis 

* Finite dement dynamics analysis performed across bounding range of impact velocities and orientations, with 
loads transmitted through inflated airbags 

- High fidelity capsule impact test 

* Will require flight like capsule with realistic load paths including tanks, airframe, airbags 

* Drop scenarios should include a representative range in impact velocities and orientations 

* Needs to include water landing scenarios with or without airbags as appropriate 

* Goal is to provide model and parameter correlation data for the impact loads and dynamics analysis as well as a 
physical demonstration that the capsule can survive impact 


This briefing is for status only and does not represent complete engineering data analysis 
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1190: Terrain characteristics 


* Element Description 

- Ground and terrain characteristics are as expected 

* Absence of accurate knowledge of ground and terrain characteristics will produce a dubious model of the 
capsule impact simulations 

* Impact on hazardous terrain may violate acceptable loads 

* Verification Approach 

- Landing site terrain survey 

* Data collection (e,g. ground GPS survey and air-SAR) for all candidate landing sites and subsequent terrain map 
generation for entire location. 

* Terrain maps should include elevation, slope, and major hazards (at capsule scale) 

* Geomorphology assessment (rock abundance and soil characteristics) 




This briefing is for status only and does not represent complete engineering data analysis 
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1191: Landing Wind Speeds 


* Verification Statement 

- Wind speeds at the time of landing are expected 

* Errors in estimated wind speed may provide unacceptable landing environments as well as inaccurate model 
capsule impact simulations and landing site dispersions. 




* Verification Approach 

- Historical wind forecast reliability analysis. 

* All inclusive study conducted for all landing sites, all seasons, and times of day 

* Confirms that historical expectations of wind speeds is within operational limits 

* Confirms that winds speeds are likely to remain within operational limits given a favorable forecast at the time 
of the go/no go de-orbit decision 


This briefing is for status only and does not represent complete engineering data analysis 
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Appendix C. Task 1 Integrated Entry, Descent and Landing Risk Matrix 


(Insert 11x17 paper) 
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Integrated Landin 

g Assessment CM Configurations 





































Configuration Name 

Vertical 

System 

RCS, 

horiz. 

Rockets 

Seat System 

Parachute 

Separation 



















Risk Break even 


Air, no RCS, Base 

Airbags 

No 

Baseline 










Air, RCS, Base 

Airbags 

Yes 

Baseline 










Air, no RCS, Alt 

Airbags 

No 

Alternate 

Yes/no 








l.E-O: 









Air, RCS, Alt 

Airbags 

Yes 

Alternate 











— . - . | 


Retro, no RCS, Base 

Retros in base 

No 

Baseline 









Retros=2e-7 

Airbaas=5e-6 1 W* 


Retro, RCS, Base 

Retros in base 

Yes 

Baseline 










Retro, no RCS, Alt 

Retros in base 

No 

Alternate 













Retro, RCS, Alt 

Retros in base 

Yes 

Alternate 









r 































l.E-O' 

4 - 

-4 


Common Design Feat 

ures and Assu 

mptions 











Retros Better / 


606 configuration with modifications/variations 










1 

1 

I 


Land landing after nominal entry 












Heatshield separates 













3 parachutes 













Suit for landing: 3/2007 Constellation Space Suit Element (CSSE) Reference Architecture has rigid bearing rings at torso and limbs 




| Assume for this study that a standard soft suit will be used instead to reduce risk of injury 




u l.E-O 1 




/ Airbags Better 

Landing site winds have ~1% chance of increasing 

to >21 fps after being OK 3 hours before landing (details elsewhere) 




1 

1 




























Configuration Details 













Airbag 2nd Gen biased system tumbles at horizontal impact velocity of: 61+ fps on dry soil, 50 fps on wet/soft soil 






| Airbag system tumbles at windspeed over 70 fps with added horizontal retros on dry soil (very unlikely) 




l.E-O' 



Retro (vertical) system tumbles at horizontal impact velocity of: 30 fps on dry soil, 22 fps on wet soil 




6 - 

/ 


| Retro (vertical) system tumbles at windspeed of 47 fps with added horizontal retros on dry soil 




l.E-O 7 - 


Roll control is in all configurations (if it's not, then add cases to the RCS/Horizontal Rocket column) 







| Horizontal rockets require roll control since they only point one direction | 







Seat System: includes seat struts, cushions, harness, etc; plus CM structure and tank placement 








baseline = JSC: as of 5/16/07 has 9 passive struts, ±8 inches of stroke in all axes 








Ibaseline results in LOC for tumbling cases | | 








altenate partially defined: 1 meter optimized stroke, 6 point harness, shoulder and head side (y axis) restraints 






lalternate performs similarly to WvL seat assumption: 80% to 100% protection from hard landing and tumbling 


l.E-07 l.E-06 l.E-05 l.E-04 l.E-03 l.E-02 l.E-01 

Retro Rocket Reliability 


Parachute Separation: only needed if some configurations will differ as to separating/staying attached after landing 







automatic cutter system may be needed due to 0.5 second timing after impact 



























Notes 




















Master sheet has all raw data 



















Configuration sheets (retro, etc) select rows of data from Master sheet 
























































Questions 




















Should we consider roll control without rockets? (Bob West parachute line latches or similar) 















Seat system is TBD. Baseline is probably passive struts. Alternate may have seat pan allowed to collapse in a controlled fashion or may have active struts. 









Does parachute system have multiple configurations? Chutes detach? 
















Does horizontal or roll control plume impinge on parachute and cause any risk? 
















Does airbag P(LOC) need to be increased for risk of pad abort to water and airbag (possibly failed) causinc 

leak and CM sinking? 











Tumbling CM P(LOC) = ? (used mostly 100%; no one died in Soyuz tumbles but they have long stroke and 

custom seat liners) 













i 


















Airbag vs. Retro Com 

parison Sensitivity 






















LOC 
















Retro 

2.1 IE-04 

2.1 IE-04 


















Airbag 

2.0 IE-04 

2.01 E-04 

1.63E-04 

1.61E-04 
















4 









































Retro 

Airbag 


















0.1 

1.00E-08 

1.00E-08 


















1 

0.000210703 

8.04E-06 


















5 

0.001053515 

4.02E-05 


















10 

0.00210703 

8.04E-05 


















50 

0.010535149 

4.02E-04 


















100 

0.021070299 

8.04E-04 







































2.00E-04 

2.00E-04 
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Based on Inputs from Jeremy Vander Kam 9/26/07. and WvL study 

Assvrriplcns, nalos 

Sinking is separated from TPS FT to make it easier to separate landing mode faili#a rates (sinking due to roll control failure Is in the Roll FT) 

Depending on level of TPS failure, outcome can vary from bumthroogh (catastrophic), to overtemp causing other subsystem failures, to locat/benign overtemp 
Probabilities for consequences due to varying levels of overtemp are coarse at this time due to design uncertainty 


Thermal Protection Subsystem Failure 
leading to LOC 

(during lunar return. Vander Kam 
inputs) 

CSV. 1.3E-4 


Thermal Protection Subsystem Failure 
leading to LOC 

(during ISS return, from WvL with 
minor updates) 

CEV. 2.7E-6 


MMOD damage that leads 
to LOC 
CEV: 2.6ES 


MMOD damage that leads 
to catastophlc failure 
CEV: 2.4E-5 




Non-MMOD TPS Failure 
(other damage, material 
response, de-bonding, 
cracking, etc) 

CEV: IE-6 


MMOD damage that leads 
to non-catastophic failure 
LOC 

CEV: 1.8E-6 


Sinking LOC for ISS return 
(updated from WvL) 
CEV: 2.3E-S 


5 


MMOD damage that leads 


Insufficient design 


Other TPS overtemp 

to LOC 


thickness leads to LOC 


leads to LOC 

CEV. negligible 


CEV.6.7E-6 


CEV. 6.7E-6 


IT 


Structure! Failure 
(insufflent margin, mfg, 
unexpected sea state, 
etc.) 

CEV. 6 E-6 (judgement} 


Structure fafcav Apollo had 
POfcuitue fat for 2 cfUsi 2<M wind) » t 3 
P(CEV 2 chUes) l 7E 3 
It P(20M. LOCJ'O 2, then 5E6 * OK 
Note Apoto had 3 chute structure n*. too 


Insufficient thickness 
leads to overtemp 
CEV: 1.3E-3 


TPS over-temp leads to cabin 
over-temp, landing system 
failure, etc 

CEV: 0.06 ( judgement ) 


Damage, debond, 
cracking, etc. leads to 
overtemp 
CEV. 1.3E-3 


MMOD damage that leads 
to non-catastophic failure 
LOC 

CEV. 1.8 E-6 


_ MMOD damage during 
extended ISS stay 


_ MMOD damage is severe 
CEV: 0.12 


MMOD damage during 
extended ISS stay 
CEV. 2E-4 


MMOD damage is not 
severe 


MMOD damage is not severe 
but causes cabin over-temp, 
landing system failure, etc 
CEV. 0.01 (judgement) 


MMOD damage during 
extended ISS stay 
CEV: 2E-4 


MMOD damage is not 


TPS over-temp leads to cabin 
over-temp, landing system 
failure, etc 

CEV. 0.06 (judgement) 


Structural Failure 
(Insufflent margin, mfg. 
unexpected sea state, 
etc.) 

CEV: 5E-6 (judgement) 


Sinking LOC for lunar 
return 

(adapted from Vander 
Kam) 


TPS overtemp leads to 
LOC 

CEV: 2.6E-4 


MMOD damage Is not severe 
but causes PV structure over- 
temp leading to sinking 
CEV: 0.1 (judgement) 


Thickness, damage, 
debond, cracking, etc. 
leads to overtemp 
CEV: 2.6 E- 3 


TPS over-temp leads to PV 
structure over-temp leading 
to sinking 

CEV: 0.1 (judgement) 
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Based on LM FTA from 3/30/2007, W vs. L, MER 

Assumptions: 

Redundancy is generally at 2 fault tolerance level 

6 airbags, but only 2 on toe side are critical, so analyses are based on those 2 
Outer (main) bags have active pyro vents (MER was passive), not flight qualified TRL 
Inner (anti-bottoming) bags stay inflated 
CEV has much better power redundancy than MER 

Packing cover is fabric with release cords, assume pyro cable cutter, MER has limited redundancy 


Airbag System Failure 
MER EDL-ARBGJNF cut set 
6E-3 including batteries 
~7E-4 without batteries 
uncertainty = 10 
CEV: 1.6E-4 


Airbag Deployment General 
Failures 
CEV: 3.2E-5 


Gas Generator (or 
Aspirator/ stored gas) Failure 
CEV: 4E-6 
MER : 6E-6 




=r 


Gas Generator Pyro Failure 
CEV: 2E-6 
MER : 3E-6 


Heater Failure 
CEV: 3E-6 
MER: 4E-6 


Deploy Signal Failure 
LM AB-DEPLOY-SIGNAL = 
AB-SENSING + AB-SIGNAL 
CEV IE-6 event 


Packing Cover Release 
Failure 

MER EDL-ARBG-REL = 
2.5E-4 w/o batt., relay, board 
CEV2E-5 event 


Airbag Structural 
Attachment Failure 
(mount HW, straps, etc) 
LM AB-STRUCT -FAILURE 
CEV: IE-6 
MER: no data 


Blow Out Plug (release 
valve) Premature Deploy 
Failure (fail open) 
(electrical/mechanical) 
(any 1 of 6 critical) 

LM AB-OUTER-BO-PLUG 
CEV: IE-5 
MER: no data 


Gas Generator Cl Failure 
MER MD-EAI-GGEN1 -FF: 
2E-6 = 4.2E-6/hour 
for 0.5 hr 


Gas Generator C2 Failure 
MER MD-EAI-GGEN2-FF: 
2E-6 = 4.2E-6/hour 
for 0.5 hr 


Gas Generator3-6 Failure 
CEV assume that if critical 
generators are OK then 
enough non-critic a I will be 
OK (multiple fault) 


Gas Generator Cl Pyro 
Failure 

MER PY-EAI-GG1 P*-*F: 
A=B=9E-6 event 


Gas Generator C2 Pyro 
Failure 

MER: A=B=9E-6 event 
common cause CC=1E-6 


Gas Generator3-6 Pyro Failure 
CEV assume that if critical 
pyros are OK then enough 
non-cr/f/ca/are OK 


Packing cover release failure includes cable cutter 

Orion Parachute Development Test June 2007 had 
drogue chute cable cutter pyros fire, but cutters did not deploy 
June 2007 at LaRC Irvin airbag drop testing had two cases 

where air bags v ented before the v ent signal was generated. 

The string holding vent petals closed failed before pyro cutter fired because 
strings were pulled tightly across a sharp edge in the pyro cutters. 


Airbag Heater A/B Failure 
MER TH-APR-ABH**-*F 
A=B= BE-6 = 1 .3 E-6/hour 
for 6 hours 

CC=9E-7 =1 .5E-7 /hour 


Gas Generator Heater Cl 
A/B Failure 

MER TH-APR-GGH**-*F 
A=B= 8E-6 = 1 .3 E-6/hour 
for 6 hours 
CC=9E-7 for 6 hours 


Gas Generator Heater C2 
A/B Failure 

MER TH-APR-GGH**-*F 
A=B= 8E-6 = 1.3E-6/hour 
for 6 hours 
CC=9E- 7 for 6 hours 


Gas Generator Heater 3-6 
A/B Failure 

CEV assume that if critical 
heaters are OK then 
enough non-critical are 
OK 


File: Landing_Assessment_Risk_Matrix_2007- 10-31- (9-22-09). xlsx; Airbag FT 
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Based on Retro Fault Tree by Ravi Prakesh 3/22/07, W vs. L, etc. 

Assumptions: 

4 horizontal rockets, 4 vertical rockets 

Initiator, Laser Initiated Ordnance System (LIOS), and Safe and Arm (S&A) are all needed to fire a rocket; all are redundant 

Late and early firing are low probability subcases: very early or late = no fire consequence; slightly early or late = 1 out consequence 


Rocket Assisted Deceleration Failure 
(failure to slow the vehicle to the 
correct velocity at the correct altitude) 


MSFC data is from iaunch abort system (LAS) reliability analysis. Assume that CM has better redundancy in motor initiation and flight software. 



OR 

Notes concerning "no retro" branch probability 
Timing requirement is in range of 0.1 second 

too tight for manual backup for activation 
it is essentially a robotic operation 
LM EDL track record 

Success: Viking 1 , 2, Stardust 
Fail: MPL (FSW cut off rockets early) 

Genesis (accelerometer mounted 
LM other problems: 

MCO LOM (navigation data) 

Spitzer (safe mode, unknown condition of 
DS-1 star tracker power supply failure 
MRO safe mode 





FSW, Command Error 


CEV: IE-4 (judgement) 



Time Critical HW Failure 
or Glitch 

(design, assembly, 
activation signal, 
altimeter, SEU, EMI, etc) 
CEV: 2E-5 (judgement) 




Altimeter Failure to 
Estimate Correctly 
(environment, terrain, 
very early, very late, etc) 
CEV: 7E-5 (judgement) 



File: Landing_Assessment_Risk_Matrix_2007-1 0-3 1-(9-22-09).xlsx, Rocket FT 
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